{"id":1604482,"url":"https://alion.io/job/intuit-senior-incident-response-security-engineer-escalations","title":"Senior Incident Response Security Engineer - Escalations","company":{"id":16628,"name":"Intuit","domain":"intuit.com","url":"https://alion.io/company/intuit","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Radancy","truth_index":{"grade":"B","score":79,"open_postings":64,"ghost_share":0,"stale_share":0.844,"repost_share":0.016,"time_to_fill_p50_days":39,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Charlotte, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":136000,"max_usd":263000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":1306},"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"CI/CD","optional":false},{"name":"Crowdstrike","optional":false},{"name":"DLP","optional":false},{"name":"Falcon","optional":false},{"name":"GCP","optional":false},{"name":"IAM","optional":false},{"name":"Incident Management","optional":false},{"name":"LLM","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"NIST AI RMF","optional":false},{"name":"OWASP","optional":false},{"name":"OWASP Top 10","optional":false},{"name":"SIEM","optional":false},{"name":"Splunk","optional":false},{"name":"Wiz","optional":false}],"status":"live","first_seen_at":"2026-09-14T00:00:00Z","employer_posted_date":"2026-09-14","last_verified_at":"2026-10-22T08:54:20Z","board_verified":true,"closed_at":null,"days_open":38,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":38},"description":"We are seeking an experienced Senior IR Security Engineer to join our Escalations team within the broader Security Operations Center (SOC), to help our organization respond to modern cyber-attacks. The ideal candidate will have a deep understanding of the security incident response and incident management process, attacker kill chains and methodologies, and the ability to respond quickly to attacks, restore services, and investigate root cause. Just as importantly, they'll be fluent in the AI-enabled SOC of today; leveraging frontier AI platforms and AI SOC tools to move faster, while understanding the new risks that AI and agentic systems introduce to the environments we defend. As a member of our SOC, you will closely collaborate with security engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to partner teams.\nResponsibilities\nOversee and promptly respond to escalated security events or investigations, and activate the security incident response plan as required.\nProvide on-call support for critical severity issues, manage communications, and report incident status to the appropriate stakeholders.\n\nLead analysis and conduct investigations to ascertain the root cause, scope, and impact of security incidents.\n\nLeverage frontier AI platforms and AI SOC tools to accelerate triage, investigation, and documentation, and help evaluate new AI capabilities as they're onboarded.\n\nInvestigate and respond to security incidents involving AI/LLM-based tools and agentic platforms (e.g., prompt injection, data leakage, unauthorized model access), extending IR playbooks to cover generative AI and AI SOC platform risks.\n\nDevelop, maintain, and improve incident response plans, procedures, and playbooks to ensure swift action and regulatory compliance.\n\nPresent guidance and training on security best practices and incident response to organizational partners, while ensuring alignment with business objectives and compliance requirements.\n\nMentor and train junior incident responders on incident handling techniques, forensic analysis, and cloud security forensics and best practices.\n\nCollaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.\n\nAssess vulnerabilities, propose remediation strategies, and stay up-to-date on current and emerging security trends, threats, and countermeasures.\n\nQualifications\nA Bachelor's degree or higher in technology, computer science, cybersecurity, or a related field is preferred.\n\nPossession of industry-recognized professional certifications, such as AWS Security Specialty, GIAC, ISC2, or emerging AI security credentials, is advantageous.\n\n3-5 years of experience in a dedicated cybersecurity role, with a strong emphasis on digital forensics and incident response.\n\n1-3 years writing scripts or code to automate security work, comfortable using AI coding assistants and AI SOC platforms to build faster, and aware of the risks that come with AI-generated code.\n\nWorking knowledge of AI/LLM security risks and mitigations (data exfiltration, insecure output handling, model/data supply chain risk, shadow AI usage), familiarity with frameworks such as the OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF.\n\nExperience performing analysis and detection engineering using endpoint detection and response (EDR) or cloud security posture management (CSPM) tools such as CrowdStrike Falcon and Wiz.\n\nComprehensive understanding of cybersecurity, networking/cloud fundamentals, and frameworks such as OWASP, MITRE ATT&CK, NIST, and CIS.\n\nExperience securing and managing public cloud services (AWS, Azure, GCP), with a focus on areas such as IAM, CI/CD pipelines, network security, and DLP.\n\nDeep understanding of Security Information and Event Management (SIEM) solutions such as Splunk or LogScale.\n\nHands-on experience triaging incidents with digital forensics tools, with expertise in the security incident response lifecycle according to frameworks like NIST or SANS.\n\nExceptional communication skills, both verbal and written, capable of explaining technical details to non-technical audiences and fostering strong stakeholder relationships.\n\nStrong analytical and problem-solving abilities, with a focus on identifying root causes and assessing risk exposure.\n\nSelf-motivated with the ability to work autonomously, managing tasks effectively and seeking assistance when necessary.\n\nProficient in working under pressure in a dynamic environment, prioritizing tasks to meet tight deadlines while maintaining procedural discipline.\n\nAdaptable and proactive attitude, willing to take on various responsibilities and eager to continuously learn and upgrade skills.\n\nIf you have a passion for security and a proven track record in incident response and security operations, we invite you to apply for this role. Join our SOC and help us protect our organization and our customers from cyber-attacks.\nIntuit provides a competitive compensation package with a strong pay for performance rewards approach. This position may be eligible for a cash bonus, equity rewards and benefits, in accordance with our applicable plans and programs (see more about our compensation and benefits at Intuit®: Careers | Benefits). Pay offered is based on factors such as job-related knowledge, skills, experience, and work location. To drive ongoing fair pay for employees, Intuit conducts regular comparisons across categories of ethnicity and gender.","description_format":"text","description_chars":5535,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Incident Response","Personal Finance Apps & Education","Accounting & Tax Software","Tax Advisory & Preparation"],"lifecycle":[{"event":"open","at":"2026-10-01T19:43:50Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 719 · green card filings: 199","filings_12m":719,"filings_prev_12m":718,"green_card_filings_12m":199,"median_offered_wage_usd":177081,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":25}],"liveness":{"score":41,"band":"fade","label":"Fading","p_open":1,"p_active":0.549,"p_room":0.75,"age_days":38,"expected_fill_days":39,"reasons":["conf:0","stale_co","velocity","win:late","comp:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":null,"html_url":"https://alion.io/job/intuit-senior-incident-response-security-engineer-escalations","json_url":"https://alion.io/job/intuit-senior-incident-response-security-engineer-escalations.json","meta":{"generated_at":"2026-10-22T11:37:03Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9630,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-23T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":16628},"rest":"https://alion.io/mcp/rest/get_company?id=16628"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fintuit-senior-incident-response-security-engineer-escalations"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fintuit-senior-incident-response-security-engineer-escalations"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fintuit-senior-incident-response-security-engineer-escalations"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/intuit-senior-incident-response-security-engineer-escalations\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fintuit-senior-incident-response-security-engineer-escalations"}]}