{"id":4240081,"url":"https://alion.io/job/blackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity","title":"Alert, Detection, and Response Engineer, Associate - Blackstone Cybersecurity","company":{"id":671320,"name":"Blackstone","domain":"blackstone.com","url":"https://alion.io/company/blackstone-2","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"C","score":66,"open_postings":93,"ghost_share":0.559,"stale_share":0,"repost_share":0,"time_to_fill_p50_days":50,"computed_at":"2026-11-12T10:38:37Z"}},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Miami, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":170000,"currency":"USD","period":"year","gross":null,"usd_annual":170000},"salary_estimate":null,"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DLP","optional":false},{"name":"IAM","optional":false},{"name":"Microsoft Defender","optional":false},{"name":"Microsoft Entra ID","optional":false},{"name":"Microsoft Sentinel","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Okta","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"AWS","optional":true},{"name":"Azure","optional":true},{"name":"GCP","optional":true},{"name":"Git","optional":true},{"name":"LLM","optional":true},{"name":"Tines","optional":true}],"status":"live","first_seen_at":"2026-09-25T00:00:00Z","employer_posted_date":"2026-09-25","last_verified_at":"2026-11-13T11:58:28Z","board_verified":true,"closed_at":null,"days_open":49,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":49},"description":"Blackstone is the world’s largest alternative asset manager. Blackstone seeks to deliver compelling returns for institutional and individual investors by strengthening the companies in which the firm invests. Blackstone’s over $1.3 trillion in assets under management include global investment strategies focused on real estate, private equity, credit, infrastructure, life sciences, growth equity, secondaries and hedge funds. Further information is available at www.blackstone.com. Follow @blackstone on LinkedIn, X (Twitter), and Instagram.\nBusiness Unit Overview:\nBlackstone Technology & Innovations (BXTI) is the technology team at the core of each of Blackstone's businesses and new growth initiatives. Serving both internal and external clients, we work to build the next generation of systems that manage risk, create efficiency and improve transparency within the firm and across our broad community of investors and portfolio companies.\nBXTI is fast paced and entrepreneurial: our open, iterative design processes and rapid pace of development mean that everyone on the team has the opportunity to make an impact from day one. We are problem solvers who can take projects from idea to implementation. We believe in active mentoring and developing excellence. We collaborate to find the best answers for our customers and for Blackstone. We are critical to the firm maintaining its competitive edge.\nPosition Overview:\nThe Alert, Detection, and Response Associate is a Tier 2 incident responder on the Alert, Detection & Response team, the front line of Blackstone's cyber defense. The Associate is responsible for detecting, investigating, and responding to information security incidents across, but not limited to, email, endpoint, identity, network, and cloud. The Associate must have strong working knowledge of incident response procedures, the technology used to execute them, as well as an understanding of how to leverage AI tools effectively. The Associate manages an incident queue, carrying cases from intake through investigation, containment, and closure, and handles the escalations raised by Tier 1 analysts. Day to day the Associate works alongside the Tier 1 and Tier 2 incident response analysts on the team, taking on the harder cases and bringing in additional responders as an investigation grows.\nThe Associate is also expected to turn what each case teaches the team into lasting improvement, feeding findings back into detections, playbooks, and automation so the same problem does not have to be worked twice. Analysts and Associates on this team are expected to play an active role in shaping investigative processes and detection capabilities, with the opportunity to see innovative ideas quickly translated into operational solutions.\nResponsibilities:\nManage an incident queue, carrying cases from intake through investigation, containment, and closure across, but not limited to, email, endpoint, identity, network, and cloud \nHandle escalations raised by Tier 1 analysts, taking on the more complex investigations and bringing in additional responders as scope grows \nInvestigate in the firm's SIEM, writing and refining searches to pivot across endpoint, authentication, email, network, and cloud telemetry \nConduct endpoint investigation, host containment, and live response in the firm's EDR platform, including process lineage, persistence review, and artifact collection \nInvestigate email threats end to end, covering phishing, business email compromise, and malicious attachments and links, using header and message trace analysis to scope who was targeted and drive remediation across affected mailboxes \nInvestigate cloud and identity compromise, covering credential misuse, role and privilege abuse, session hijacking, and multi-factor bypass \nInvestigate third-party and SaaS provider compromise, questioning the provider's incident response team to establish containment status and what Blackstone data was affected, independently scoping the firm's exposure by hunting provider indicators across endpoint, email, network, and cloud telemetry, and coordinating findings and remediation with legal and compliance, vendor risk, and the business owners of the affected service \nServe as a core member of the incident response team, scoping intrusions, driving containment and eradication, briefing stakeholders, and escalating in line with the firm's severity model \nAuthor and tune detections from investigation findings, developing the logic and validating it against historical and live data, then taking it through review into production and confirming afterward that it fires on real activity without generating unacceptable noise \nWork alongside agentic AI investigation tooling on first-pass triage and enrichment, judging its conclusions, escalating what it gets wrong, and feeding corrections back so coverage improves \nHelp extend detection and response coverage across the firm's growing use of AI, an emerging and fast-moving part of the attack surface \nTurn investigation findings into lasting coverage by authoring and tuning detections, reducing false positives on noisy ones, and building automation that removes repetitive steps from triage, enrichment, and response \nMentor Tier 1 analysts on investigation technique, sharing tradecraft through case reviews and hands-on coaching \nDocument investigations and incidents to a standard that holds up under scrutiny, maintain evidence handling and chain of custody, and communicate findings clearly to technical teams and senior stakeholders \nContribute to threat hunts and purple team exercises, using red team activity and threat intelligence to find gaps before an adversary does \nParticipate in incident response and the SOC on-call rotation (occasional, roughly quarterly) to respond to escalated security incidents \nQualifications:\n2+ years of hands-on experience in security operations, incident response, or a comparable technical security role \nDemonstrated experience running security investigations end to end, from alert through root cause and containment, in a SOC or IR setting \nHands-on SIEM experience with experience writing and troubleshoot your own queries; experience with a major enterprise SIEM and its native query language (for example Splunk/SPL, Microsoft Sentinel/KQL, or Elastic) \nHands-on EDR experience conducting endpoint investigation and containment; experience with a leading EDR platform (for example CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint) \nWorking knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO, and identity providers such as Okta or Microsoft Entra ID \nPractical understanding of attacker behavior across the intrusion lifecycle, including phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration \nFamiliarity with the security technologies an investigation touches: email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data \nWorking knowledge of MITRE ATT&CK and experience mapping observed activity to technique \nExperience scripting in Python and/or PowerShell for enrichment, parsing, and automation of repetitive analysis \nDemonstrated hands-on use of AI tooling in real work, with experience speaking in detail about several projects, professional or otherwise, where you used AI to automate or accelerate a task, and sound judgment about where its output cannot be trusted \nClear technical writing, with experience explaining an incident and its impact to both engineers and non-technical stakeholders \nExperience self-organizing, prioritizing under time pressure, and staying accurate during a live incident \nPreferred Qualifications:\nDetection engineering experience: authoring or tuning SIEM correlation searches, EDR custom rules, or Sigma content, and measuring whether a detection actually works\nExperience with detection-as-code practices, including Git-based workflows, peer review, and CI validation of detection content\nSOAR automation experience (Torq, Splunk SOAR, Tines, or similar)\nDigital forensics capability in memory, disk, or network analysis, or hands-on malware triage and sandboxing\nExperience with agentic AI or LLM-assisted security tooling, and with AI security monitoring platforms\nThreat hunting experience, particularly hypothesis-driven hunts against endpoint or cloud telemetry\nWorking knowledge of at least one major cloud platform (AWS, Azure, or GCP), including how its logging, identity, and access services are used to investigate activity in the environment\nExperience in financial services or another heavily regulated, globally distributed environment\nAt least one active security certification such as Security+, GCIH, GCFA, GCIA, GCED, CySA+, or a vendor SIEM certification\nB.S. in Computer Science, Cybersecurity, Information Systems, or a related technical field\nThe duties and responsibilities described here are not exhaustive and additional assignments, duties, or responsibilities may be required of this position. Assignments, duties, and responsibilities may be changed at any time, with or without notice, by Blackstone in its sole discretion.\nExpected annual base salary range:\n$110,000 - $170,000Actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, qualifications and job location. For roles located outside of the US, please disregard the posted salary bands as these roles will follow a separate compensation process based on local market comparables.\nAdditional compensation and benefits offered in connection with the roleconsist of comprehensive health benefits, including but not limited to medical, dental, vision, and FSA benefits; paid time off; life insurance; 401(k) plan; and discretionary bonuses. Certain employees may also be eligible for equity and other incentive compensation at Blackstone’s sole discretion.\nBlackstone is committed to providing equal employment opportunities to all employees and applicants for employment without regard to race, color, creed, religion, sex, pregnancy, national origin, ancestry, citizenship status, age, marital or partnership status, sexual orientation, gender identity or expression, disability, genetic predisposition, veteran or military status, status as a victim of domestic violence, a sex offense or stalking, or any other class or status in accordance with applicable federal, state and local laws. This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, transfer, leave of absence, compensation, and training. All Blackstone employees, including but not limited to recruiting personnel and hiring managers, are required to abide by this policy.\nIf you need a reasonable accommodation to complete your application, please contact Human Resources at 212-583-5000 (US), +44 (0)20 7451 4000 (EMEA) or +852 3656 8600 (APAC).\nDepending on the position, you may be required to obtain certain securities licenses if you are in a client facing role and/or if you are engaged in the following:\nAttending client meetings where you are discussing Blackstone products and/or and client questions;\n\nMarketing Blackstone funds to new or existing clients;\n\nSupervising or training securities licensed employees;\n\nStructuring or creating Blackstone funds/products; and\n\nAdvising on marketing plans prepared by a sales team or developing and/or contributing information for marketing materials.\n\nNote: The above list is not the exhaustive list of activities requiring securities licenses and there may be roles that require review on a case-by-case basis. Please speak with your Blackstone Recruiting contact with any questions.\nTo submit your application please complete the form below. Fields marked with a red asterisk * must be completed to be considered for employment (although some can be answered \"...","description_format":"text","description_chars":12170,"description_truncated":true,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Life insurance"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cybersecurity","Information Security","Asset Management & Funds","Hedge Funds & Alternative Investments"],"lifecycle":[{"event":"open","at":"2026-11-13T11:58:28Z"}],"visa":[{"country":"US","licensed_sponsor":true,"adverts_offering_sponsorship_24m":0,"sanctioned_now":false,"evidence":"H-1B filings in 12 months: 102 · green card filings: 16","filings_12m":102,"filings_prev_12m":89,"green_card_filings_12m":16,"median_offered_wage_usd":161144,"route":null,"cap_exempt":false,"checked_at":"2026-11-12T07:36:15+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":45,"band":"ok","label":"Likely open","p_open":1,"p_active":0.754,"p_room":0.6,"age_days":49,"expected_fill_days":50,"reasons":["conf:3","win:late","crowd:junior,brand"],"computed_at":"2026-11-13T15:52:58Z"},"pay":{"stated_usd_annual":170000,"is_top_pay":true},"html_url":"https://alion.io/job/blackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity","json_url":"https://alion.io/job/blackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity.json","meta":{"generated_at":"2026-11-13T15:52:58Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":31857,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-14T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.1,"usd":0.01,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":671320},"rest":"https://alion.io/mcp/rest/get_company?id=671320"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fblackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"free","price":{"credits":0,"usd":0},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fblackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.1,"usd":0.01},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fblackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/blackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fblackstone-alert-detection-and-response-engineer-associate-blackstone-cybersecurity"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":4240081}},{"tool":"search_jobs","arguments":{"company":"blackstone.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":4240081},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}