Note: The job is a remote job and is open to candidates in USA. Barracuda is a cybersecurity company providing protection for email, data, applications, networks, and managed XDR services. The company is seeking a Senior Endpoint Security & IR Engineer to lead SentinelOne XDR management, incident response investigations, threat containment, forensic analysis, detection engineering, automation, and client communications in a multi-tenant MSSP environment.
Responsibilities
- Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned
- Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale
- Design custom detection rules within SentinelOne and fine tune protection policies
- Investigate alerts and threats detected by SentinelOne, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping
- Analyze Microsoft 365 security incidents including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks
- Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration
- Leverage Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry
- Document findings in clear, executive-ready incident reports tailored to both technical and non-technical stakeholders
- Participate in a 24/7 on-call rotation
- Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions
- Build and optimize automated response workflows in Tines to accelerate containment and MTTR
- Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence
- Integrate tooling across the security stack to streamline IR workflows and reduce manual effort
- Serve as the primary IR point of contact for client stakeholders during active incidents
- Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews
- Deliver actionable remediation guidance tailored to each client's environment and risk tolerance
- Maintain SLA commitments for incident acknowledgment, updates, and resolution
- Contribute to client security posture assessments and IR readiness recommendations
Skills
- Expert knowledge and experience in SentinelOne – Key Requirement
- Proven experience in windows, mac and linux environments
- Participate in a 24/7 on-call rotation
- Minimum of bachelor's degree in computer science and 5+ years of hands-on experience in incident response, digital forensics, or security operations
- Demonstrated ability to manage multiple client engagements simultaneously
- Proven track record investigating real-world incidents including ransomware, BEC Attacks, lateral movement, data exfiltration etc
- Experience working in multi-tenant environments with diverse security maturity levels
- GIAC certification required; one or more of the following:
- GCIH (GIAC Certified Incident Handler)
- GCFA (GIAC Certified Forensic Analyst)
- GCFE (GIAC Certified Forensic Examiner)
- GNFA (GIAC Network Forensic Analyst)
- Equivalent certifications considered: OSCP, eCIR, eCDFP, EnCE, SC-200, AZ-500
- DFIR - Binalyze AIR - remote acquisition, triage, timeline analysis and artifact collection
- EDR - SentinelOne threat investigations, Deep Visibility, detection engineering, policy configuration
- Microsoft 365 / Defender - BEC investigation, UAL analysis, Safe Links/Attachments, Entra ID etc
- Analytics - Databricks - large-scale log analysis, SQL/Python notebooks, threat hunting at scale
- Automation - workflow automation, playbook development, API integrations and continuous monitoring
- MSSP, MDR, or consulting experience is strongly preferred
- Experience with additional EDR platforms (CrowdStrike, Microsoft Defender for Endpoint)
- Advanced knowledge of macOS and Linux forensics
- Familiarity with threat intelligence platforms (MISP, Recorded Future, Virus Total Enterprise)
- Experience with Velociraptor, KAPE, or Volatility for advanced forensic collection and investigations
- Prior experience in IR teams or serving as an IR practice SME
Benefits
- Remote work arrangement
- Internal mobility – there are opportunities for cross training and the ability to attain your next career step within Barracuda.
- Equity, in the form of non-qualifying options
- High-quality health benefits
- Retirement Plan with employer match
- Career-growth opportunities
- Flexible Time Off and Paid Time Off benefits
- Volunteer opportunities
Company Overview
Company H1B Sponsorship