Sr Engineer - Cybersecurity Incident Response

$134,400 - $181,800/Yr

T-Mobile US - Frisco, TX

Full-time - Mid Level

Onsite - Frisco, TX

Telecommunications

About the position

T-Mobile is seeking a highly skilled and experienced Senior Engineer to join our Cybersecurity Threat Response Team. This position is critical in ensuring the security and integrity of our operations by effectively managing and responding to cybersecurity threats. The ideal candidate will possess a deep understanding of cybersecurity threats, advanced technical skills in threat detection and mitigation, and the ability to lead and contribute to complex response efforts following the incident handling lifecycle. This role requires collaboration with various business owners to identify, analyze, contain, mitigate, and recover from various threats, thereby fulfilling our mission of protecting T-Mobile and our customers. In this role, you will conduct comprehensive analyses of security alerts and threats from various sources to identify potential risks and assess their impact on our operations. You will develop and implement incident response plans, working swiftly to contain and mitigate cybersecurity risks. Partnering with internal teams and external collaborators, you will investigate security breaches and implement effective remediation strategies. Additionally, you will manage post-incident operations, including tracking lessons learned and making infrastructure improvements to enhance overall security. Effective communication with leadership and other partners is essential, as you will provide updates on response efforts and recommend proactive measures for risk mitigation. You will document incident findings, analysis, and response actions clearly in accordance with T-Mobile's policies and regulatory requirements. Your contributions will also include enhancing T-Mobile's incident detection and response capabilities through continuous improvement initiatives, tuning opportunities, and knowledge sharing. You will implement security-related projects as assigned by management to improve T-Mobile's security practices and posture, while also providing guidance and training to peers and junior team members, promoting a culture of continuous learning and improvement within the team. Staying ahead of the latest trends, threats, and standard methodologies in cybersecurity is a commitment you will uphold in this role.

Responsibilities

• Conduct comprehensive analysis of security alerts and threats from various sources to identify potential risks and assess their impact on operations.
• Develop and implement incident response plans, working swiftly to contain and mitigate cybersecurity risks.
• Partner with internal teams and external collaborators to investigate security breaches and implement effective remediation strategies.
• Manage post-incident operations, including tracking lessons learned and making infrastructure improvements to enhance overall security.
• Communicate effectively with leadership and other partners to provide updates on response efforts and recommend proactive measures for risk mitigation.
• Document incident findings, analysis, and response actions clearly in accordance with T-Mobile's policies and regulatory requirements.
• Contribute to the enhancement of T-Mobile's incident detection and response capabilities through continuous improvement initiatives, tuning opportunities, and knowledge sharing.
• Implement security-related projects as assigned by management to improve T-Mobile Security practices and posture.
• Provide guidance and training to peers and junior team members, promoting a culture of continuous learning and improvement within the team.
• Demonstrate commitment to staying ahead of the latest trends, threats, and standard methodologies in cybersecurity.

Requirements

• Bachelor's Degree in Computer Science, Information Technology, Cybersecurity or equivalent work experience.
• Over 4 years of experience in information security technology or a related field.
• More than 2 years of experience in handling and responding to security breaches.
• 2+ years Incident response with enterprise or cloud environments (preferred).
• Expertise in network security, endpoint security, malware analysis, digital forensics, and threat intelligence.
• Proficiency with security tools such as SIEM, IDS/IPS, EDR, and forensic analysis software.
• Strong analytical and problem-solving skills, with the ability to think critically under pressure.
• Experience in identifying root causes and implementing effective solutions.
• Working expertise in enterprise security subject areas such as design architecture, networking, web services, encryption, obfuscation, tokenization technologies, cloud, telecommunications.
• Experience with the analysis of underlying technologies that form the solution vital for the application of threat identification, analysis, and thread model design.
• In-depth knowledge of security standard methodologies in large-scale environments.
• Knowledge of Scripting tools (Python/Perl/Shell/HTML/PHP).
• Demonstrable knowledge of current threat trends and technology developments in the area of info security.
• Ability to work and communicate with multi-functional teams and assist in developing swim lanes.
• Dedicated with ability to plan, organize and prioritize tasks to complete independently; Ability to work under stress and meet timelines.

Nice-to-haves

• CISSP, CCSK, CCSP, CISA/CISM (preferred).
• GCIH, GCFE, GCFA, GNFA, GCIA, GREM or similar (preferred).
• Ability to serve as an incident commander running bridges, effectively managing and overseeing the entire incident response lifecycle from detection to resolution.
• Sophisticated understanding of IP/Security solutions & technologies applicable to the Wireless Network Architecture.
• Hands-on experience with digital forensics investigations supporting incident response efforts.
• Knowledge of forensic tooling such as Axiom, KAPE, Encase, X-Ways, Cellebrite, Sumuri, etc.
• Memory analysis & Malware Reverse Engineering experience.
• Knowledge of federal & compliance regulations e.g. SOX, PCI & CPNI.
• Experience with MITRE ATT&CK Kill Chain threat modeling and NIST/SANS Incident Handling Lifecycle.
• Experience with Cyber Legal & Privacy investigations.
• Experience with Threat Detection, Threat Hunting, & Insider Threat investigations.
• Experience in SOAR and automation use case development.
• Experience with Cyber Threat Intelligence operations beyond VirusTotal including curating intelligence from investigations, identifying TTPS, and Threat Intel Platforms (TIP), such as MISP.

Benefits

• Medical, dental and vision insurance
• Flexible spending account
• 401(k)
• Employee stock grants
• Employee stock purchase plan
• Paid time off and up to paid 12 holidays
• Paid parental and family leave
• Family building benefits
• Back-up care
• Enhanced family support
• Childcare subsidy
• Tuition assistance
• College coaching
• Short and long term disability
• Voluntary AD&D coverage
• Voluntary accident coverage
• Voluntary life insurance
• Voluntary disability insurance
• Voluntary long-term care insurance
• Mobile service & home internet discounts
• Pet insurance
• Access to commuter and transit programs