Security Engineer I

UiPath

Security Operations Engineer focused on threat management and incident response. Contributing to security incident investigations and collaborating with senior engineers in a remote environment.

Posted 5/27/2026full-timeRemote • Washington • 🇺🇸 United StatesJunior💰 $115,000 - $150,000 per yearWebsite

Tech Stack

Tools & technologies

CloudSplunk

About the role

Key responsibilities & impact

Triage and investigate incidents across SIEM, EDR, network, identity, and cloud telemetry; support containment, eradication, and incident communications under senior guidance.
Contribute to root cause analysis and close the loop with Threat Intelligence and Detection Engineering to produce durable detections, controls, or playbook updates.
Participate in proactive threat hunting across enterprise and cloud telemetry under the direction of senior analysts.
Help maintain IR playbooks and runbooks and participate in drills and tabletop exercises.
Recommend and help tune the detection and response tooling stack (SIEM, EDR, SOAR, case management) in both environments
Actively seek mentorship from senior IR engineers and grow toward independent ownership of incidents over time.
Follow strict procedures and requirements for but not limited to the authorized IR Plan, NIST 800-53 IR controls, CISA notifications, chain of custody, data classification handling, and event classification and reporting requirements.

Requirements

What you’ll need

Minimum 1 year of experience in a Security Operations role (SOC analyst, junior incident responder, detection engineer, or equivalent), internship, or relevant academic/lab work.
Hands-on exposure to at least one major SIEM (Sentinel, Splunk, Chronicle, Elastic) and at least one EDR (Defender XDR, CrowdStrike, SentinelOne).
Developing ability to write and run KQL queries (or willingness to ramp quickly).
Practical experience using coding agents and/or LLM tooling, with judgment about when to validate or escalate.
US citizen or US lawful permanent resident (green card holder).
Able to work from our Bellevue, WA office a minimum of 3 days per week.
Ability to successfully complete a background investigation appropriate to a FedRAMP Moderate environment.
Familiarity with NIST SP 800-53 and NIST SP 800-61 concepts (or commitment to develop working knowledge within the first 90 days) to support work inside the FedRAMP boundary.
Awareness of FedRAMP Moderate, authorization boundary concepts, and federal incident reporting expectations - or eagerness to learn them quickly.

Benefits

Comp & perks

None specified 📊 Check your resume score for this job Improve your chances of getting an interview by checking your resume score before you apply. Check Resume Score

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

incident responseroot cause analysisthreat huntingKQL queriescoding agentsLLM toolingSIEMEDRSOARcase management

Soft Skills

mentorshipcommunicationteam collaborationindependent ownershipjudgment

Certifications

NIST 800-53NIST SP 800-61