Engineer III - Cyber Incident Response

About the role

The Engineer III – Cyber Incident Response is a senior technical position within Cencora’s Security Operations Center. You will lead complex investigations, mentor junior analysts, and work closely with global cyber‑defense teams to protect the organization’s digital assets.

Key responsibilities

• Lead investigation and remediation of advanced threats such as APTs, ransomware, phishing, and insider activity.
• Perform forensic analysis on endpoints, networks, and cloud environments to determine root cause and scope.
• Develop and refine incident response playbooks, runbooks, and detection use cases.
• Collaborate with threat intelligence, vulnerability management, and countermeasure teams to strengthen defenses.
• Escalate high‑severity incidents to senior leadership and provide clear reporting.
• Act as technical escalation point for Engineer I/II analysts.
• Participate in red‑team and purple‑team exercises and after‑action reviews.
• Mentor and train junior engineers on best practices and investigative techniques.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, IT or equivalent; Master’s preferred.
• 7+ years of progressive cybersecurity experience, with at least 4 years in incident response or SOC operations.
• Proven ability to investigate advanced threats and coordinate response across teams.
• Strong written and verbal communication skills for documenting and presenting findings.

Required skills

• Hands‑on experience with SIEM, EDR, SOAR platforms.
• Proficiency with tools such as Splunk, CrowdStrike, EnCase, and Wireshark.
• Knowledge of forensic analysis, threat hunting, and incident response methodologies.