{"id":2838548,"url":"https://alion.io/job/lexisnexis-consultingprincipal-security-engineer","title":"Consulting/Principal Security Engineer","company":{"id":6793,"name":"LexisNexis","domain":"lexisnexis.com","url":"https://alion.io/company/lexisnexis-legal","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":81,"open_postings":61,"ghost_share":0,"stale_share":0.77,"repost_share":0,"time_to_fill_p50_days":38,"computed_at":"2026-10-22T06:10:10Z"}},"role":"Security","role_family":"Security","seniority":"lead","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Raleigh, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":104900,"max":174700,"currency":"USD","period":"year","gross":null,"usd_annual":174700},"salary_estimate":null,"experience_years_min":10,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Azure","optional":false},{"name":"GCP","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"JavaScript","optional":true},{"name":"Node JS","optional":true}],"status":"live","first_seen_at":"2026-08-24T00:00:00Z","employer_posted_date":"2026-08-24","last_verified_at":"2026-10-22T02:29:05Z","board_verified":true,"closed_at":null,"days_open":60,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":60},"description":"Principal Incident Response Lead\nJob Profile Summary\nThe Principal Incident Response Lead position provides strategic and tactical leadership for enterprise incident response across a complex hybrid environment. This role serves as the senior incident commander and technical authority for high-severity security events, providing executive-ready decision support based on evolving threats, attack techniques, and advances in technology. The position supports the Information Security department’s goals and objectives by leading escalations, guiding containment and recovery actions, and driving measurable improvements to response readiness and detection effectiveness. This role requires deep expertise in leading complex incident response efforts across hybrid environments and advancing cloud-native detection and monitoring capabilities, particularly within AWS. The role also owns the incident response program’s readiness lifecycle-including tabletops, cyber range exercises, and after-action governance-to ensure continuous improvement and operational resilience.\nJob Description\nBASIC FUNCTIONS: This position will provide strategic and tactical incident response leadership, providing management with insight and input into overall security operations decisions based on advances in technology and the evolving threat landscape. The position supports the Information Security department’s goals and objectives by leading escalations and coordinating response activities across multiple technical teams, ensuring consistent execution of triage, containment, eradication, and recovery. This position serves as the senior incident commander, establishes and maintains incident response readiness (playbooks, communications patterns, exercises), and drives detection and response improvements through lessons learned and measurable program outcomes.\nQUALIFICATIONS:\n10+ years of IT security experience, including significant incident response leadership in enterprise environments\nBS Engineering/Computer Science or equivalent experience required; advanced degree preferred\nPreferred: incident handling/forensics-focused certifications (e.g., GCIH, GCFA or equivalent) and cloud security certification(s) (AWS/Azure/GCP)\nTECHNICAL SKILLS:\nAdvanced knowledge of modern security operations environments, including hybrid enterprise architectures and common attack paths.\nDemonstrated experience leading incident response activities across complex hybrid environments, including on-premises infrastructure and multi-cloud platforms (AWS, Azure, GCP).\nStrong hands-on experience engineering detections, telemetry, and monitoring solutions within AWS (e.g., CloudTrail, GuardDuty, VPC Flow Logs, and related services).\nExpertise in incident command practices: severity assessment, stakeholder coordination, containment strategies, evidence handling, eradication and recovery planning, and post-incident review.\nStrong ability to monitor, triage, and investigate security events; apply structured analysis for anomalous activity and adversary behaviors.\nExperience with enterprise logging and telemetry pipelines, log onboarding strategies, and data quality expectations (coverage, fidelity, retention).\nExperience improving detection quality and signal-to-noise (e.g., tuning, suppression, enrichment, validation, and feedback loops).\nWorking knowledge of identity and access security concepts (SSO/MFA, privileged access, conditional access) and identity-driven attack patterns and detections.\nUnderstanding of compliance and governance initiatives and the ability to translate requirements into operational controls, procedures, and evidence.\nVulnerability and exposure understanding sufficient to prioritize response actions (active exploitation, blast radius, compensating controls) and guide remediation.\nFamiliarity with automation/SOAR concepts and scripting for investigation and response workflows (e.g., Python/PowerShell or equivalent).\nAbility to develop and implement incident response programs with measurable outcomes (response readiness, containment speed, detection coverage, exercise cadence).\nStrong organization/project planning, time management, and change management skills across multiple functional groups and departments, including prioritizing work during incident conditions.\nAdvanced problem-solving experience involving leading teams in identifying, researching, and coordinating resources necessary to troubleshoot/diagnose complex issues; success translating findings into options/solutions; identifying risks/impacts and schedule adjustments to facilitate management decision-making.\nAdvanced communication (verbal and written) and customer service skills, including the ability to brief senior/executive leadership with clear, concise, decision-oriented updates.\nACCOUNTABILITIES:\nServe as the senior incident commander and technical lead for high-severity incidents; drive structured triage, containment, eradication, and recovery across the enterprise.\nLead and coordinate incident response efforts for high-severity events spanning hybrid and multi-cloud environments (on-prem, AWS, Azure, GCP), ensuring effective containment, eradication, and recovery.\nOwn and continuously improve the incident response program: playbooks/runbooks, severity definitions, escalation paths, on-call expectations, evidence handling standards, and crisis communications patterns.\nPlan, run, and mature readiness activities including tabletop exercises and cyber range events; define objectives, measure outcomes, and ensure follow-through on remediation actions.\nOwn after-action governance: facilitate post-incident reviews, establish root cause and contributing-factor analysis, drive corrective action plans, and track closure to completion (closed-loop improvement).\nLead analysis and review of security events for anomalous activity; collaborate with peer groups to take appropriate action to safeguard company information assets against current and foreseen threats.\nDrive improvements to detection, investigation, and response processes through lessons learned, measurable corrective actions, and operational performance metrics.\nDrive the design, implementation, and continuous improvement of detection engineering and monitoring capabilities within AWS environments.\nPartner with infrastructure, cloud, endpoint, identity, and application teams to ensure response-ready logging, telemetry, and access to required investigative data sources.\nProvide guidance for threat-informed mitigation and hardening activities resulting from incidents (e.g., containment controls, identity protections, logging improvements, segmentation, credential hygiene).\nCommunicate incident status, impact, and risk in executive-ready written and verbal updates; produce high-quality incident summaries and post-incident reports.\nSupport compliance and governance efforts by operationalizing response procedures, documenting evidence, and ensuring repeatable execution aligned to policy and regulatory expectations.\nAssist with reviewing tools, applications, and processes to strengthen and optimize current incident response and detection capabilities, identify gaps, and recommend practical solutions to enhance effectiveness.\nAssess and measure incident response program effectiveness to ensure closed-loop operations (e.g., readiness/exercise cadence, time-to-contain, repeat incident reduction, detection coverage and quality).\nAll other duties as assigned.\n\nU.S. National Base Pay Range: $104,900 - $174,700. Geographic differentials may apply in some locations to better reflect local market rates.\n\nThis job is eligible for an annual incentive bonus.\n\nWe know your well-being and happiness are key to a long and successful career. We are delighted to offer country specific benefits. Clickhereto access benefits specific to your location.\nWe are committed to providing a fair and accessible hiring process. If you have a disability or other need that requires accommodation or adjustment, please let us know by completing our Applicant Request Support Form or please contact 1-855-833-5120.\nCriminals may pose as recruiters asking for money or personal information. We never request money or banking details from job applicants. Learn more about spotting and avoiding scamshere.\nPlease read our Candidate Privacy Policy.\nWe are an equal opportunity employer: qualified applicants are considered for and treated during employment without regard to race, color, creed, religion, sex, national origin, citizenship status, disability status, protected veteran status, age, marital status, sexual orientation, gender identity, genetic information, or any other characteristic protected by law.\nUSA Job Seekers:\nEEO Know Your Rights.","description_format":"text","description_chars":8741,"description_truncated":false,"requirements":{"experience_years_min":10,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Legal AI","Legal Software"],"lifecycle":[{"event":"open","at":"2026-10-19T08:01:38Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 2 · green card filings: 23","filings_12m":2,"filings_prev_12m":0,"green_card_filings_12m":23,"median_offered_wage_usd":128700,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":0}],"liveness":{"score":18,"band":"cold","label":"Long shot","p_open":1,"p_active":0.499,"p_room":0.36,"age_days":59,"expected_fill_days":38,"reasons":["conf:3","stale_co","velocity","win:tail","crowd:brand"],"computed_at":"2026-10-22T06:10:10Z"},"pay":{"stated_usd_annual":174700,"is_top_pay":false},"html_url":"https://alion.io/job/lexisnexis-consultingprincipal-security-engineer","json_url":"https://alion.io/job/lexisnexis-consultingprincipal-security-engineer.json","meta":{"generated_at":"2026-10-23T01:31:26Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":2501,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":6793},"rest":"https://alion.io/mcp/rest/get_company?id=6793"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Flexisnexis-consultingprincipal-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Flexisnexis-consultingprincipal-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Flexisnexis-consultingprincipal-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/lexisnexis-consultingprincipal-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Flexisnexis-consultingprincipal-security-engineer"}]}