Security Engineer, Detection & Response

The Security Engineer - Detection & Response is a key member of the Lockton Global Security Operations team. This is a dual-purpose role. During an incident, this person leads the technical response from detection through recovery. When there is no active incident, their time goes toward preventing the next one: running cyber threat intelligence (CTI), executing red team and purple team exercises, hunting for threats in our environment, and strengthening our detections. The role also serves as the senior technical escalation point for the Security Operations Center (SOC).
The ideal candidate is a hands-on practitioner who is equally comfortable leading a live incident bridge, tracking the threat actors most likely to target Lockton, and emulating those actors to prove our defenses work.

Key Responsibilities:

Incident Response
• Incident Leadership: Lead the technical response to security incidents, coordinating with IT, Legal, HR, Communications, and business stakeholders to scope, contain, eradicate, and recover. Own incident documentation and ensure communication and escalation processes are followed.
• Forensic Analysis: Conduct digital forensic investigations across endpoint, identity, email, and cloud to collect and analyze evidence. Preserve the integrity of data and produce detailed forensic and incident reports.
• Root Cause and Lessons Learned: Conduct root cause analysis on every significant incident and turn findings into concrete changes to detections, controls, and playbooks.
• Readiness: Maintain and improve incident response playbooks and runbooks. Plan and run tabletop exercises with technical and executive audiences across regions.

Cyber Threat Intelligence
• Intelligence Program: Build and run Lockton's CTI capability. Collect, analyze, and prioritize intelligence from commercial feeds, open sources, information sharing communities, vendor partners, and peer relationships.
• Threat Actor Tracking: Track the threat actors, campaigns, and techniques most relevant to Lockton, the insurance and financial services sector, and the regions where we operate. Maintain actor profiles and produce regular threat briefings for security leadership and the broader team.
• Operationalizing Intelligence: Turn intelligence into action. Feed indicators and behaviors into our detection stack, generate hunt hypotheses, inform vulnerability prioritization, and support security awareness content on active phishing, vishing, and social engineering campaigns.
• Threat Hunting: Lead intelligence-driven threat hunts across endpoint, identity, cloud, email, and SaaS telemetry. Convert hunt findings into durable detections.

Red Team and Purple Team Exercises
• Adversary Emulation: Plan and execute red team and purple team exercises, including assumed breach, identity and cloud attack paths, and social engineering scenarios, under approved rules of engagement. Emulate the TTPs of the actors identified through CTI.
• Detection Validation: Work side by side with the SOC and detection engineering to measure whether our controls detect and respond as expected. Map coverage and gaps to MITRE ATT&CK.
• Remediation: Deliver clear findings with prioritized remediation, then retest to confirm gaps are closed.

SOC Escalation
• Escalation Point: Serve as the senior technical escalation for the SOC, including our managed detection and response partner, on complex or high-severity alerts. Guide triage decisions and make the call on when an alert becomes an incident.
• Detection Improvement: Tune and improve detection content and SOC playbooks based on escalations, incidents, hunts, and exercise results. Reduce false positives and close visibility gaps.
• Mentoring: Raise the technical bar of the SOC through knowledge sharing, documented escalation procedures, and coaching on investigation techniques.

General
• Collaboration: Work closely with IT, Legal, and other departments to ensure a coordinated and comprehensive response to security threats.
• Must be able to respond to security-related emergencies that may arise outside of regular business hours.
• Participate in security team On-Call rotation.

• Bachelor's degree in Computer Science, Information Security, or a related field, or equivalent experience.
• Minimum of 5 years of experience in information security, with hands-on experience in at least two of the following: incident response, digital forensics, cyber threat intelligence, threat hunting, red team or penetration testing.
• Relevant certifications such as GCIH, GCFA, GCTI, GREM, OSCP, CRTO, or CISSP are highly desirable.
• Working knowledge of MITRE ATT&CK and experience applying it to threat hunting, detection coverage, and adversary emulation.
• Hands-on experience with EDR and SIEM platforms. Experience with CrowdStrike Falcon, Microsoft Sentinel, and Microsoft Defender XDR is a strong plus.
• Strong understanding of the Microsoft ecosystem, including Windows internals, Active Directory and Entra ID attack paths, Microsoft , and Azure.
• Experience with scripting and query languages (PowerShell, Python, KQL) for automation, analysis, and detection development.
• Experience with adversary emulation tooling (for example, Atomic Red Team, MITRE Caldera, or command and control frameworks) and running exercises safely in production environments.
• Excellent problem-solving skills and the ability to work under pressure.
• Meticulous attention to detail to ensure the accuracy and integrity of forensic investigations and incident reports.
• Strong written and verbal communication skills, with the ability to produce intelligence products and incident reports for both technical and executive audiences.
• Ability to work effectively in a team environment and collaborate with cross-functional teams.
• Willingness to stay current with attacker tradecraft, cloud security, and emerging threats such as AI-enabled attacks, and continuously enhance skills.

#LI-JM