{"id":1196910,"url":"https://alion.io/job/archer-aviation-senior-incident-response-engineer","title":"Senior Incident Response Engineer","company":{"id":6898,"name":"Archer Aviation","domain":"archer.com","url":"https://alion.io/company/archer","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"A","score":91,"open_postings":98,"ghost_share":0.061,"stale_share":0,"repost_share":0.01,"time_to_fill_p50_days":99,"computed_at":"2026-10-21T05:46:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["San Jose, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":131000,"max_usd":253000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":5,"visa_sponsorship":true,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"Bash","optional":false},{"name":"CMMC","optional":false},{"name":"Cortex","optional":false},{"name":"Cortex XSOAR","optional":false},{"name":"GCP","optional":false},{"name":"Google SecOps","optional":false},{"name":"Linux","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Windows","optional":false},{"name":"YARA","optional":false},{"name":"YARA","optional":false},{"name":"Cuckoo Sandbox","optional":true},{"name":"Ghidra","optional":true},{"name":"IDA Pro","optional":true},{"name":"Prometheus","optional":true}],"status":"live","first_seen_at":"2026-09-24T16:55:24Z","employer_posted_date":"2026-09-24","last_verified_at":"2026-10-21T19:25:44Z","board_verified":true,"closed_at":null,"days_open":27,"trust":{"level":"ok","repost_count":0,"flags":["company_stale"],"days_open":26},"description":"Headquartered in Silicon Valley, California, Archer is a leader in the next-gen aerospace sector building an end-to-end advanced air mobility platform that delivers air taxis, unmanned aircraft systems (“UAS”), aviation-related physical artificial intelligence (“AI”) solutions, and other technologies to customers worldwide across the commercial aerospace and defense sectors.\nOur sights are set high and our problems are hard, and we believe that diversity in the workplace is what makes us smarter, drives better insights, and will ultimately lift us all to success. We are dedicated to cultivating an equitable and inclusive environment that embraces our differences, and supports and celebrates all of our team members.\nJob Overview\nWe are seeking a Senior Incident Response (IR) Engineer to lead Archer's detection and remediation efforts. You will serve as the primary technical liaison to our Managed Security Service Provider (MSSP), translating alerts into actionable responses while ensuring compliance with NIST SP 800-171. This role requires deep expertise in digital forensics, threat hunting, and enterprise security operations across SIEM, SOAR, and security platforms to collaborate with infrastructure and security teams to rapidly contain threats and improve our security posture.\nKey Responsibilities\nServe as Archer's primary internal SIEM engineer, working closely with internal resources and our MSSP for the triage & validation of alerts, defining escalation thresholds, and ensuring accurate tuning of security tools and detection rules.\nLead the technical response to validated security incidents including identification, containment, eradication, and recovery, coordinating cross-functional response teams during breaches, malware outbreaks, and insider threats.\nConduct deep-dive forensic investigations including memory analysis, disk imaging, timeline reconstruction, and evidence preservation, producing detailed incident reports for HR, legal, and regulatory stakeholders.\nExecute proactive threat hunts using SIEM data to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).\nDevelop, refine, and validate custom detection rules mapped to the MITRE ATT&CK framework, considering Archer-specific threats and compliance-driven use cases.\nDesign and maintain incident response playbooks and SOAR workflows to automate evidence collection, containment actions, and notification procedures.\nDesign log collection requirements and facilitate external compliance audits to ensure adherence to NIST SP 800-171 Audit and Accountability (AU) requirements, CMMC Level 2 practices, and SOX ITGC expectations.\nManage endpoint and system detection policies, deploy sensors, and perform live response actions to contain active threats and collect forensic artifacts during incidents.\nIdentify and consume Archer-relevant cyber threat intelligence (CTI) feeds and operationalize IOCs and threat actor TTPs into detection logic.\nOwn the IR documentation architecture: author, organize, and continuously maintain incident response procedures, playbooks, and runbooks to ensure consistency, clarity, and audit-readiness.\nOwn and evolve Archer's IR program strategy, metrics, and roadmap, reporting progress and risk posture to the CISO and executive leadership.\nProvide technical guidance and tabletop exercise facilitation to IT, application, and leadership teams on incident reporting procedures, response protocols, and lessons learned from post-incident reviews.\nRequired Qualifications\n5+ years in Incident Response or Security Operations (SOC), with proven experience managing MSSP relationships, alert triage, and SLA performance.\nHands-on experience investigating security incidents from initial detection through containment and eradication, including malware analysis, phishing attacks, ransomware, and insider threats.\nDeep understanding of OS internals (Windows/Mac/Linux), network protocols, and proficiency in scripting (Python, PowerShell, Bash) for automation.\nWorking knowledge of SIEM platforms (Google SecOps/Chronicle, Splunk, Microsoft Sentinel) and query languages (YARA-L/GoogleSQL, SPL, KQL) to hunt for threats and validate MSSP detections.\nHands-on experience with SOAR platforms (Google SecOps/Chronicle, Palo Alto Cortex XSOAR, Splunk Phantom SOAR) to design and execute automated response workflows.\nKnowledge of Cyber Threat Intelligence standards and User Behavior Analytics (UEBA).\nStrong technical writing skills, with demonstrated experience authoring, structuring, and maintaining security documentation, including playbooks, runbooks, and incident response procedures.\nDemonstrated experience designing, leading, and facilitating tabletop exercises, purple team engagements, or incident simulations for technical and executive audiences.\nDemonstrated experience conducting proactive threat hunts using SIEM and EDR telemetry to identify lateral movement, persistence mechanisms, and indicators of compromise (IOCs).\nBroad security utility across the stack, with working familiarity with firewalls and network security, cloud security (AWS/Azure/GCP), and application security (AppSec) practices, enabling cross-domain support beyond core IR/SOC responsibilities.\nExcellent technical and executive writing and communication skills, with the ability to translate complex threat data and incident timelines for both technical teams and executive leadership during high-pressure situations.\nPreferred Qualifications\nAdvanced malware analysis skills (static/dynamic) using IDA Pro, Ghidra, or Cuckoo Sandbox.\nFamiliarity administering email security platforms (Material Security, ProofPoint, Check Point Harmony) and conducting phishing campaigns.\nStrong understanding of NIST SP 800-171 and CMMC Level 2 requirements, specifically as they relate to Incident Response (IR) and Audit/Accountability (AU).\nFamiliarity with aerospace and startup environments.\nPlease note that this job description is intended to provide a general overview of the position and does not include an exhaustive list of responsibilities and qualifications.\nAt Archer we aim to attract, retain, and motivate talent that possess the skills and leadership necessary to grow our business. We drive a pay-for-performance culture and reward performance that supports the Company’s business strategy. For this position we are targeting a base pay between $144,000 - $180,000. Actual compensation offered will be determined by factors such as job-related knowledge, skills, and experience.\nArcher is committed to working with and providing reasonable accommodations to job applicants with physical or mental disabilities, and those with sincerely held religious beliefs. Applicants who may require reasonable accommodation for any part of the application or hiring process should provide their name and contact information to Archer’s People Team at . Reasonable accommodations will be determined on a case-by-case basis.\nInformation collected and processed as part of any job applications you choose to submit is subject to Archer's Candidate Privacy Policy.\nCertain positions may be eligible for visa sponsorship.\nArcher is proud to be an Equal Opportunity employer committed to diversity and inclusivity in the workplace. All aspects of employment are decided on the basis of merit, qualifications, and business needs. We do not discriminate based upon race, color, religion, sex, sexual orientation, age, national origin, disability status, protected veteran status, gender identity or any other characteristic protected by federal, state or local laws.\nArcher Aviation does not engage with external recruiting agencies/individual recruiters with whom it does not have a prior written agreement. Archer reserves the right to make use of any unsolicited resumes that it receives and bears no responsibility for payment of any fees asserted from the use of unsolicited resumes. If you are a recruiting agency or individual recruiter wishing to do business with Archer, please reach out to . All employment processes are managed by the Archer People Team.","description_format":"text","description_chars":8138,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Aerospace Manufacturing","Aircraft Manufacturing"],"lifecycle":[{"event":"open","at":"2026-09-24T19:02:23Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 91","filings_12m":91,"filings_prev_12m":0,"green_card_filings_12m":0,"median_offered_wage_usd":192500,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":3}],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":26,"expected_fill_days":99,"reasons":["conf:1","win:early"],"computed_at":"2026-10-21T05:46:15Z"},"pay":null,"html_url":"https://alion.io/job/archer-aviation-senior-incident-response-engineer","json_url":"https://alion.io/job/archer-aviation-senior-incident-response-engineer.json","meta":{"generated_at":"2026-10-21T21:40:52Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":30877,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-22T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6898},"rest":"https://alion.io/mcp/rest/get_company?id=6898"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Farcher-aviation-senior-incident-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Farcher-aviation-senior-incident-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Farcher-aviation-senior-incident-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/archer-aviation-senior-incident-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Farcher-aviation-senior-incident-response-engineer"}]}