Incident Response Engineer @ Turing

IT & Security (1)

About Turing

Based in San Francisco, California, Turing is the world’s leading research accelerator for frontier AI labs and a trusted partner for global enterprises looking to deploy advanced AI systems. Turing accelerates frontier research with high-quality data, specialized talent, and training pipelines that advance thinking, reasoning, coding, multimodality, and STEM. For enterprises, Turing builds proprietary intelligence systems that integrate AI into mission-critical workflows, unlock transformative outcomes, and drive lasting competitive advantage.

Recognized by Forbes, The Information, and Fast Company among the world’s top innovators, Turing’s leadership team includes AI technologists from Meta, Google, Microsoft, Apple, Amazon, McKinsey, Bain, Stanford, Caltech, and MIT. Learn more at www.turing.com

Job Description

Turing provides a platform that connects talents with our enterprise customers in a global marketplace. Our security engineers work on a broad set of efforts focusing on scaling and automating security infrastructure and processes. Our security engineers work on building the industry standard and implementing the best security practices in our platforms that connect enterprise environments. Our security engineers define and enforce the security protocols to operate services in a protected environment. Our security engineers also build and manage the framework for data access both internally and externally.

At Turing, we are continuously addressing the complex challenges of scaling our systems in a safe and secure manner. We’re looking for passionate security engineers and leaders who are excited to solve intricate security problems in dynamic enterprise environments.

Overview

We are seeking an experienced Incident Response Engineer to join our global security operations team. Based in India as part of a shared technical escalation pool, this role is central to handling complex security incidents, engineering detection capabilities, and leading forensic investigations. You will drive improvements in detection content, response automation, and mentor junior analysts while supporting critical security infrastructure and processes.

Responsibilities:

Lead complex investigations into advanced threats, including root cause analysis, malware behaviour, persistence mechanisms, and forensic evidence collection across cloud and endpoint environments.
Build lightweight tools and scripts to support forensic analysis, incident enrichment, or threat hunting (e.g., log correlation, IOC extraction).
Act as the Incident Commander (IC) during high-severity incidents, leading technical response and coordinating with stakeholders across IT, Legal, and Engineering.
Provide feedback on SIEM detection logic (e.g., Chronicle rules, UDM mappings) based on real investigations and hunting findings, in collaboration with MDR and Detection Engineering.
Contribute to SOAR playbook development and refinement - including enrichment, escalation logic, and automated containment steps to accelerate incident handling and reduce response time.
Define escalation criteria, triage workflows, and decision trees to guide team to ensure clear handoffs for high-priority incidents.
Collaborate with platform owners to tune and validate security tools (e.g., EDR policies, SOAR workflows) for effective incident detection and response.
Provide input on detection and response tooling gaps based on incident experience and help evaluate solutions where needed.
Build or extend automation for investigation tasks, enrichment, or containment actions using APIs and lightweight scripts.
Conduct proactive threat hunts using IOC searches, TTP mapping (MITRE ATTACK), and internal behavioural data to detect hidden or emerging threats.
Develop threat hunting hypotheses based on current threat landscape or recent incidents, test them using available telemetry, and document outcomes and recommendations.
Mentor team through real-case reviews, knowledge sharing, and training sessions to strengthen their triage, investigation, and escalation skills.
Contribute to internal playbooks and IR documentation to ensure procedures, tools, and best practices are clearly documented and regularly updated.

Qualifications Needed:

Required Skills

Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or related field (or equivalent practical experience).
5+ years of experience in Security Operations, Incident Response, or Detection Engineering roles.
Demonstrated experience with digital forensics, malware analysis, and network-based incident investigations.
Strong hands-on experience with SIEM platforms such as Splunk, Chronicle, Elastic, or QRadar.
Proficiency in scripting languages (e.g., Python, Bash, PowerShell), and familiarity with configuration formats like YAML for automation and tooling.
Deep understanding of EDR solutions (e.g., CrowdStrike, SentinelOne) and SOAR platforms.
Working knowledge of the MITRE ATT&CK framework and TTP-driven detection and response.
Familiarity with threat intelligence and applying it to hunt and detect advanced threats.
Excellent communication and collaboration skills, especially during incident handling.

Good to have:

Industry-recognized certifications such as GIAC GCFA, GCIH, GREM, GCIA, or OSCP.
Experience with memory analysis tools (e.g., Volatility, Rekall).
Experience handling security incidents in cloud-native environments (e.g., GCP, Azure, SaaS platforms).
Experience writing detection logic using YARA, Sigma rules, or Sysmon.
Familiarity with automation platforms (e.g., Phantom, XSOAR, StackStorm).
Contributions to open-source IR tools or threat research communities.
Experience integrating security tooling with workflow platforms (e.g., Slack, Jira) to support response automation and incident coordination.
Knowledge of compliance-driven incident response requirements (e.g., SOC 2, ISO 27001, breach notifications).

Values:

We are client first: We put our clients at the center of everything we do, because their success is the ultimate measure of our value.
We work at Start-Up Speed: We move fast, stay agile and favor action because momentum is the foundation of perfection
We are Al forward: We help our clients build the future of Al and implement it in our own roles and workflow to amplify productivity.

Advantages of joining Turing:

Amazing work culture (Super collaborative & supportive work environment; 5 days a week)
Awesome colleagues (Surround yourself with top talent from Meta, Google, LinkedIn etc. as well as people with deep startup experience)
Competitive compensation
Flexible working hours

Don’t meet every single requirement? Studies have shown that women and people of color are less likely to apply to jobs unless they meet every single qualification. Turing is proud to be an equal opportunity employer. We do not discriminate on the basis of race, religion, color, national origin, gender, gender identity, sexual orientation, age, marital status, disability, protected veteran status, or any other legally protected characteristics. At Turing we are dedicated to building a diverse, inclusive and authentic workplace and celebrate authenticity, so if you’re excited about this role but your past experience doesn’t align perfectly with every qualification in the job description, we encourage you to apply anyways. You may be just the right candidate for this or other roles.

For applicants from the European Union, please review Turing's GDPR notice here.

Incident Response Engineer

Turing

Job Description

Overview

Responsibilities:

Qualifications Needed:

Values:

Advantages of joining Turing:

Simplify's Take

What believers are saying

What critics are saying

What makes Turing unique

Benefits

Growth & Insights and Company News

6 month growth

1 year growth

2 year growth