Security Engineer, Detection & Response

• Security Engineer, Detection & Response
• Kansas City, Missouri , United States of America
• Information Technology
• Apply now Share
• Security Engineer, Detection & Response
• Kansas City, Missouri , United States of America
• Information Technology
• Apply now Share
• Working at Lockton
• Business unit
• Lockton Center Services
• Lockton Benefits Offerings
• The ideal candidate is a hands-on practitioner who is equally comfortable leading a live incident bridge, tracking the threat actors most likely to target Lockton, and emulating those actors to prove our defenses work.
• Incident Response
• Forensic Analysis: Conduct digital forensic investigations across endpoint, identity, email, and cloud to collect and analyze evidence. Preserve the integrity of data and produce detailed forensic and incident reports.
• Root Cause and Lessons Learned: Conduct root cause analysis on every significant incident and turn findings into concrete changes to detections, controls, and playbooks.
• Readiness: Maintain and improve incident response playbooks and runbooks. Plan and run tabletop exercises with technical and executive audiences across regions.
• Cyber Threat Intelligence
• Intelligence Program: Build and run Lockton's CTI capability. Collect, analyze, and prioritize intelligence from commercial feeds, open sources, information sharing communities, vendor partners, and peer relationships.
• Threat Hunting: Lead intelligence-driven threat hunts across endpoint, identity, cloud, email, and SaaS telemetry. Convert hunt findings into durable detections.
• Red Team and Purple Team Exercises
• Detection Validation: Work side by side with the SOC and detection engineering to measure whether our controls detect and respond as expected. Map coverage and gaps to MITRE ATT&CK.
• Remediation: Deliver clear findings with prioritized remediation, then retest to confirm gaps are closed.
• SOC Escalation

None flagged.