Principal Cybersecurity Engineer

** About Your Future with Top Build***“Great Place to Work”*## ##
** Job Description
** We are hiring a highly experienced, hands-on cybersecurity engineer who can detect, investigate, and resolve security issues quickly, improve detection signal quality over time, and automate repeatable security operations s is an execution role with a broad technical scope and strong operational influence.

The person in this role will be expected to own outcomes, improve security operations maturity, and operate effectively across incident response, detection engineering, DFIR, automation, and enterprise security tooling.
** What you’ll do
**** Incident Response, DFIR, and Threat Mitigation
*** Lead complex incident investigations end-to-end, including triage, scoping, containment, eradication, remediation, and post-incident follow-up.
* Perform root cause analysis and define preventive control improvements.
* Conduct and/or lead digital forensics and malware analysis activities, including sandboxed analysis when appropriate.
* Perform advanced threat hunting across endpoint, identity, network, email, and cloud telemetry.
* Coordinate response efforts across internal teams and MSSP partners to ensure timely escalation, containment, and resolution.
* You will be part of the on-call rotation, requiring you to be on standby and respond to high-severity alerts for 1 week every 5 weeks.
** Detection Engineering and Security Monitoring Optimization
*** Build, tune, and improve detections across SIEM, EDR/EPP, email security, identity, network, and cloud platforms.
* Reduce false positives and improve signal quality through data-driven tuning and use-case development.
* Design and optimize security data flows, triage pipelines, and alert enrichment.
* Integrate and tune threat intelligence inputs to improve detection and response outcomes.
** Security Automation and AI-Enabled Security Operations
*** Design, build, and maintain security automation using scripting, SOAR, integrations, and cloud/serverless components.
* Develop automations that materially reduce manual effort and improve response speed, consistency, and analyst effectiveness.
* Build and support AI-assisted security workflows (e.g., LLM-enabled triage, retrieval workflows, analyst augmentation) in secure environments.
* Implement and maintain AI guardrails, output validation, model evaluation, and governance controls for AI-enabled security operations.
* Ensure automation and AI outputs are safe, auditable, and reliable for production use.
** Security Tooling, Endpoint, and Network Security Engineering
*** Optimize and operate EDR/EPP platforms to improve visibility, detection quality, and response actions.
* Fine-tune security controls across SIEM, EDR, firewall, IDS/IPS, proxy, and related platforms.
* Review and optimize firewall policies/rules, segmentation, VPN controls, and related network security controls.
* Support security control reviews and hardening aligned to enterprise risk requirements.
** Operations Leadership and Technical Influence
*** Act as a senior technical liaison with MSSP partners, validating escalations, triage quality, and response outcomes.
* Improve SOC workflows, playbooks, and operational handoffs.
* Mentor junior analysts and engineers.
* Contribute to security architecture discussions and design reviews while remaining hands-on and execution-focused.
** Required Qualifications
**** Experience and operational scope
*** 20+ years of progressive experience in cybersecurity, server infrastructure, and enterprise/data center operations.
* Demonstrated experience in enterprise-scale and/or MSSP-scale security operations.
* Experience supporting large environments, high asset counts, and high user populations.
* Experience operating in regulated environments and working within established security/compliance frameworks.
** Core cybersecurity expertise
*** Expert-level capability in Incident Response and Detection Engineering.
* Deep hands-on expertise in:  + Digital forensics / DFIR  + Threat detection and threat hunting  + Penetration testing  + Information systems management  + Malware analysis/malware reversing  + Security monitoring and triage…