Senior Cyber Defense Engineer

Arrow Electronics

Senior Cyber Defense Engineer protecting Arrow’s enterprise through incident response, digital forensics, and threat detection. Improving SIEM, EDR, cloud security, and automation capabilities.

Posted 8/13/2026full-timeColorado • 🇺🇸 United StatesSenior💰 $121,300 - $192,693 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in leading complex cyber incident investigations and incident response across diverse environments, including cloud and on-premises. Proficient in digital forensic analysis, threat hunting, and developing automation solutions to enhance security operations.

Highest-signal resume keywords

Cyber Incident ResponseDigital Forensic AnalysisThreat HuntingSIEM PlatformsScripting and Automation

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Digital Forensic AnalysisIncident ResponseThreat HuntingMalware AnalysisEvidence CollectionDetection EngineeringAutomationKusto Query LanguagePowerShellSQL

Soft Skills

MentoringCommunicationLeadership

Tools & Technologies

Microsoft SentinelSplunkMicrosoft Defender XDRCrowdStrikeSentinelOneAzureAWSGCPSOAREDR

Certifications & Qualifications

GCFAGCFEGCIHGCIAGREMGCFRGNFAGCTIOSCPCEH

Industry Keywords

Cyber SecurityDFIRIncident Response FrameworksMITRE ATT&CKEnterprise Security OperationsNetwork SecurityEmail SecurityCloud SecurityComplianceRegulatory Investigations

Tech Stack

Tools & technologies

AWSAzureCloudCyber SecurityGoogle Cloud PlatformPythonSplunkSQL

About the role

Key responsibilities & impact

Lead complex cyber incident investigations across enterprise, cloud, hybrid, and on-premises environments
Conduct end-to-end incident response including triage, scoping, containment, eradication, recovery, and post-incident reporting
Investigate network intrusions, account compromise, ransomware, insider risk, fraud-related incidents, unauthorized access, and advanced threat activity
Preserve evidence and maintain chain of custody for forensic, legal, compliance, and regulatory investigations
Produce investigative findings, root cause analyses, executive summaries, and remediation recommendations
Perform DFIR across Windows, cloud, identity, endpoint, network, and application environments
Conduct forensic examinations, artifact analysis, timeline analysis, and evidence collection
Analyze suspicious files, malware behavior, persistence mechanisms, attacker tooling, and indicators of compromise
Conduct proactive threat hunting and improve SIEM detections, correlation rules, KQL queries, alerts, dashboards, and response workflows
Support security tool engineering, administration, optimization, log onboarding, data normalization, telemetry validation, and use-case development
Build scripts, queries, automation, dashboards, and technical workflows to improve investigation speed and quality
Support AI-assisted security workflows, automation, agents, scripting, prompt testing, and operational governance
Support threat emulation and purple team activities to validate detections, controls, and response procedures
Serve as a senior technical lead during significant investigations and incident response efforts
Mentor SOC Leads, Security Analysts, Incident Responders, and Security Engineers
Contribute to playbooks, runbooks, investigation standards, threat hunting procedures, and operational documentation
Communicate with technical teams, leadership, Legal, HR, Compliance, and business stakeholders

Requirements

What you’ll need

5–10+ years of experience in Cyber Security, Incident Response, DFIR, Threat Hunting, Detection Engineering, Security Operations, or related disciplines
Proven experience leading enterprise-level cyber incident response investigations
Hands-on experience with digital forensic analysis, evidence collection, malware analysis, and investigative reporting
Experience across cloud, hybrid, identity, endpoint, network, and on-premises enterprise environments
Experience developing detections, automations, playbooks, scripts, queries, or engineering solutions
Strong understanding of Microsoft Entra ID, Active Directory, Azure, Microsoft 365, identity security, and enterprise authentication
Strong understanding of Windows operating systems, endpoint telemetry, authentication logs, forensic artifacts, and persistence mechanisms
Knowledge of cloud security across Azure, AWS, GCP, SaaS, identity, logging, and monitoring environments
Knowledge of incident response frameworks, cyber kill chain, MITRE ATT&CK, threat intelligence, and threat-informed defense
Knowledge of enterprise security operations including SIEM, EDR, NDR, SOAR, vulnerability data, network security, and email security
Hands-on experience with SIEM platforms such as Microsoft Sentinel, Splunk, QRadar, or equivalent
Hands-on experience with EDR/XDR platforms such as Microsoft Defender XDR, Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or equivalent
Experience with digital forensic tools, forensic imaging, artifact collection, timeline analysis, endpoint investigation, and evidence handling
Scripting, querying, and automation using PowerShell, Python, Kusto Query Language, SQL, APIs, or equivalent
Experience with detection engineering, threat hunting, malware triage, alert tuning, dashboards, correlation rules, and response workflows
Experience performing artifact-based investigations across endpoint, identity, email, cloud, and network data sources
Knowledge of Windows forensic artifacts, registry analysis, event logs, authentication patterns, persistence techniques, and attacker behaviors
Ability to analyze phishing, credential theft, lateral movement, privilege escalation, command execution, and data access
Ability to produce forensic timelines, investigative findings, executive summaries, and remediation recommendations
Ability to operate independently during urgent or high-impact incidents while maintaining accuracy, documentation, and evidence integrity
Bachelor’s degree in Cyber Security, Computer Science, Information Technology, Digital Forensics, or related field is preferred; equivalent experience considered
Preferred certifications include GCFA, GCFE, GCIH, GCIA, GREM, GCFR, GNFA, GCTI, OSCP, CEH, CISSP, Microsoft Security Operations Analyst, Microsoft Cybersecurity Architect, or other relevant certifications
Must be able to travel to an Arrow office location as requested by Arrow leadership

Benefits

Comp & perks

Medical, Dental, Vision Insurance
401k, With Matching Contributions
Short-Term/Long-Term Disability Insurance
Health Savings Account (HSA)/Health Reimbursement Account (HRA) Options
Paid Time Off (including sick, holiday, vacation, etc.)
Tuition Reimbursement
Growth Opportunities
Competitive financial compensation
Employee Referral Process