Principal Incident Response Engineer

Blackbaud Open · verified Oct 24, 2026

Remote United States Full-time Senior Security Operations & Analysis

At a glance

Senior Security Operations & Analysis role at Blackbaud. Remote, United States · full-time · $117,200–$157,500 base.

SalaryStated by Blackbaud

$117,200 – $157,500

Base salary for this role, in USD per year, as published in the posting.

RoleSecurity Operations & Analysis

SenioritySenior

LocationUnited States

WorkplaceRemote

EmploymentFull-time

Base pay$117,200–$157,500

PostedSep 23, 2026 · 4w ago

Role brief

remoteroles summary, based on the employer's posting.

What you'll do

Assess security alerts and indicators to establish what happened and how serious each incident is
Lead response to major incidents, coordinating teams to contain threats and limit their impact
Investigate incidents across on-premises, hybrid, and cloud systems, then set out recovery and remediation steps
Run intelligence-led hunts for detection gaps and work with detection engineering to broaden MITRE ATT&CK coverage
Develop AI and LLM use cases for incident detection and response, and support evidence handling with legal and law enforcement

What you bring

At least eight years handling cyber incident response in a relevant environment
Deep practical knowledge of response methods, security frameworks, and SIEM, IDS/IPS, EDR, and cloud monitoring tools
Can collect and examine endpoint and network artifacts, volatile memory, malicious files, binaries, and scripts
Have used digital forensics platforms such as EnCase, FTK, Axiom, or Cellebrite to investigate incidents

Who this fits

This senior, hands-on role suits an experienced incident responder who can lead high-severity cases and support an on-call rotation. It is remote within the United States. Cybersecurity certifications such as CISSP, GCIH, GFCA, GREM, or ECIH are desirable.

From the employer

About the role:

We are looking for an accomplished, high-performing Principal Incident Response Engineer for our Threat Detection & Response team with experience performing digital forensics, incident response, and threat hunting.

The Principal Incident Response Engineer is responsible for ensuring the confidentiality, integrity, and availability of critical information and IT assets. This role requires a deep understanding of cybersecurity principles, incident response methodologies, digital forensics, and the ability to work efficiently under pressure.

What you'll be doing:

Conduct in-depth analysis of security events and indicators to determine the nature and severity of incidents.
Respond promptly to security incidents, following established incident response procedures.
Serve as the technical lead for high-severity security incidents. Coordinate and collaborate with cross-functional teams to contain and mitigate cyber threats effectively.
Perform forensic investigations to determine the root cause of incidents and develop appropriate remediation strategies across on-prem, hybrid, and cloud workloads
Lead regular intelligence-driven threat hunt activities to identify and investigate gaps in detection.
Partner with detection engineering to increase coverage across MITRE ATT&CK framework
Identify, scope, and support the development of AI/LLM workflows to enhance incident detection and response capabilities.
Collaborate with other forensic analysts, law enforcement officers, and legal experts to identify methods and procedures for recovery, preservation, and presentation of computer evidence, ensuring proper precautions are taken in the preservation and prevention of spoliation of electronic evidence.
Support On-call rotation as applicable

What we'll want you to have:

8+ years of cyber incident response experience in a relevant environment. Cyber industry certifications are highly desirable (CISSP, GCIH, GFCA, GREM, ECIH).
Subject matter expertise with security tools and technologies, such as SIEM, IDS/IPS, EDR, and cloud monitoring solutions.
Strong knowledge of incident response methodologies, including containment, eradication, recovery, and common security frameworks (NIST, SANS, CSA).
Ability to acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries and scripts.
Experience with forensic tools, such as Encase, FTK, Axiom, and Cellebrite to carry out digital forensic investigations.

Stay up to date on everything Blackbaud, follow us on Linkedin, Twitter, Instagram, Facebook and YouTube

Blackbaud powers social impact through purpose‑driven technology and responsible AI. Guided by our Intelligence for Good® vision, we’re building a culture where innovation, trust, and human expertise come together to help organizations make a greater difference in the world.

Blackbaud is proud to be an equal opportunity employer and is committed to maintaining a diverse and inclusive work environment. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, physical or mental disability, age, or veteran status or any other basis protected by federal, state, or local law.

The starting base pay is $117,200.00 to $157,500.00. Blackbaud may pay more or less based on employee qualifications, market value, Company finances, and other operational considerations.

Benefits Include: