Engineer II - Cyber Incident Response

About the role

The Engineer II – Cyber Incident Response works within Cencora’s Security Operations Center to detect, investigate, and remediate cybersecurity threats. This mid‑level position collaborates with global cyber‑defense teams to contain incidents, minimize impact, and continuously improve detection capabilities.

Key responsibilities

• Investigate and respond to incidents such as phishing, malware, ransomware, and unauthorized access.
• Analyze logs, alerts, and forensic data to assess scope and impact.
• Escalate high‑severity cases to senior staff with clear documentation.
• Assist in containment, eradication, and recovery activities.
• Develop and maintain SOC playbooks, runbooks, and SOPs.
• Work with threat intelligence, vulnerability management, and forensics teams to enhance detection.
• Participate in lessons‑learned sessions and recommend process improvements.
• Mentor junior analysts (Engineer I) on investigative techniques.

Required profile

• Bachelor’s degree in Cybersecurity, Computer Science, IT, or equivalent experience.
• 5+ years of progressive cybersecurity experience, with at least 2 years in SOC or incident response.
• Strong knowledge of incident response methodology and adversary tactics.
• Familiarity with NIST, MITRE ATT&CK, and ISO 27035 frameworks.
• Preferred certifications: GCIH, GCIA, CompTIA Security+, CompTIA CySA+, CEH.

Required skills

• Hands‑on experience with SIEM platforms (e.g., Splunk).
• Endpoint Detection and Response tools (e.g., CrowdStrike).
• Forensic analysis tools (e.g., Wireshark).
• Log and alert analysis for incident investigations.
• Incident response process development and execution.

What we offer

• Opportunity to work in a global, innovative health‑focused organization.
• Collaboration with cross‑functional cyber‑defense teams.
• Professional development and mentorship for junior staff.