Fico

Overview

As a Senior/Lead Incident Response Engineer at FICO, you will lead our defensive security operations with a strong focus on people, preparedness, and cross-team readiness.

About Fico

FICO is a leading global analytics software company, helping businesses in 100+ countries make better decisions.

Requirements & Eligibility

• In-depth experience designing and facilitating IR tabletop exercises or similar simulations
• Strong interpersonal skills: calm under pressure, a skilled facilitator, a trusted relationship-builder across teams, and an effective coach and mentor
• Experience in enterprise incident response across the full IR lifecycle
• Good working knowledge of forensics tools (such as Magnet Axiom, Velociraptor, Volatility, FTK, Autopsy) and AWS cloud security fundamentals
• Good understanding of cloud security and AI security concepts
• Must have at least one of the following certifications, or similar: GCIH, GCFA, GCFE, AWS Certified Solutions Architect, or CISSP

Key Responsibilities

• Design and facilitate incident response tabletop exercises across security, IT, engineering, legal, and business teams, testing preparedness and surfacing gaps.
• Own the full incident lifecycle: detection, triage, containment, eradication, recovery, and post-incident review.
• Build and maintain IR plans, playbooks, and runbooks for consistent, repeatable response.
• Partner with threat intelligence, SOC, and engineering to turn IR and exercise findings into stronger detection and controls.
• Communicate clearly with stakeholders at all levels, during incidents and in reporting.
• Support digital forensics investigations, apply the PICERL and NIST frameworks, and lead IR activities in cloud environments using SIEM, CSPM, and other cloud security tooling.
• Bring an IR perspective to FICO’s cloud and AI security programs and use AI and automation in IR and tabletop exercise workflows.