Senior Security Engineer - Digital Forensics and Incident Response (DFIR)

Intuit is seeking a Senior Security Engineer to join our Digital Forensics and Incident Response (DFIR) team within the Security Operations Center (SOC) to help the organization respond to cyber-attacks. The ideal candidate will have a deep understanding of incident response and incident management, attacker kill chains and methodologies, and the ability to respond quickly, restore services, and conduct forensically sound root-cause investigations. The role involves defending against emerging AI and agentic system risks, tuning detections, and building threat hunting capabilities. You will collaborate with other engineers to design and implement solutions, improve incident response readiness, and provide guidance and training to external teams.

Responsibilities

• Oversee and promptly respond to escalated security events or investigations and activate the Security Incident Response Plan as required.
• Provide on-call support for critical severity issues, manage communications, and report incident status to the appropriate stakeholders.
• Lead forensic analysis and investigations to determine root cause, scope, and impact of security incidents.
• Investigate and respond to incidents involving AI/LLM-based tools and agentic platforms, including data leakage, insecure output handling, and unauthorized model access, and extend IR playbooks to cover generative AI and AI SOC platform risks.
• Develop, maintain, and improve incident response plans, procedures, and playbooks to ensure swift action and regulatory compliance.
• Leverage AI SOC platforms and frontier AI tools to accelerate triage, detection tuning, investigation, and documentation, and evaluate new AI capabilities as they are onboarded.
• Present guidance and training on security best practices and incident response to organizational partners, aligning with business objectives and compliance requirements.
• Mentor and train incident responders on incident handling techniques, forensic analysis, and cloud security forensics and best practices.
• Collaborate with Compliance, Legal, and Risk teams to integrate incident response operations with business and regulatory needs.
• Assess vulnerabilities, propose remediation strategies, and stay up-to-date on current and emerging security trends, threats, and countermeasures.

Requirements

• A Bachelor’s degree or higher in Technology, Computer Science, Cybersecurity, or a related field, or equivalent hands-on experience.
• Professional certifications such as AWS Security Specialty, GCIH, GCFA, GFCE, CISSP, or emerging AI security credentials are advantageous.
• 3–5 years of experience in a dedicated cybersecurity role with emphasis on digital forensics and incident response.
• 1–3 years of experience writing scripts or code (Bash, PowerShell, Python) to automate security work; comfortable using AI coding assistants and AI SOC platforms, with awareness of risks associated with AI-generated code.
• Working knowledge of AI/LLM security risks and mitigations, including data exfiltration, insecure output handling, model and data supply chain risk, and shadow AI usage; familiarity with OWASP Top 10 for LLM Applications, MITRE ATLAS, and NIST AI RMF.
• Experience performing analysis and detection engineering using Endpoint Detection and Response or Cloud Security Posture Management tools such as CrowdStrike Falcon and Wiz.
• Proven threat hunting experience with hypothesis-driven hunts across endpoint, cloud, and network telemetry to uncover threats that evade existing detections.
• Strong understanding of cybersecurity, networking, and cloud fundamentals, and frameworks such as OWASP, MITRE ATT&CK, NIST, and CIS.
• Experience using and defending Public Cloud services (AWS, Azure, and GCP) including IAM, CI/CD Pipelines, Network Security, and DLP.
• Deep understanding of SIEM solutions such as Splunk and LogScale.
• Excellent analytical and problem-solving abilities with a focus on root cause and risk assessment.
• Exceptional communication skills, both verbal and written, with the ability to explain technical details to non-technical audiences and build strong stakeholder relationships.
• Self-motivated, able to work autonomously, manage tasks effectively, and seek assistance when needed.
• Ability to work under pressure in a dynamic environment, prioritizing tasks to meet tight deadlines while maintaining procedural discipline.
• Proficiency in digital forensics technologies and methodologies, and expertise in the Security Incident Response Lifecycle per frameworks such as NIST or SANS.
• Adaptable and proactive, willing to take on various responsibilities and continuously learn and upgrade skills.