Threat Response & Remediation Engineer

We are looking for a Threat Response & Remediation Engineer to join our team. This is a Remote role, reporting to the Manager, Threat Response & Remediation in the Threat Response & Remediation department. In this role, you will act as a trusted partner and virtual boots on the ground for our customers, driving investigations, containing threats, and delivering complete remediation. You will take full ownership of customer success from detection through resolution, providing the expertise and clear communication needed to ensure their environments remain secure.

• →Perform investigations into detected threats using EDR, Network, and Identity telemetry to analyze, contain, and remediate threats in customer environments
• →Identify, scope, and manage ongoing customer incidents, developing remediation plans, and providing customers with thorough, clear reports of actions taken
• →Identify effective response strategies and innovative uses for existing tools to enhance customers' security posture, maximize efficiency, and minimize vulnerability
• →Collaborate with Detection Engineering, Intelligence, Research, and Product Management teams to develop new approaches to threat remediation and provide strategic insights for product improvement
• →Participate in an on-call rotation to provide 24x7 response and remediation coverage

• You thrive in ambiguity and feel comfortable building the path forward in a dynamic environment, viewing complex security challenges as opportunities to build meaningful solutions.
• You act like an owner with a deep passion for the mission and a strong bias for action, seamlessly navigating between high-level incident response strategy and hands-on technical execution.
• You are a natural problem-solver who is energized by finding solutions to complex technical challenges, knowing that resolving the hardest security incidents delivers the biggest customer impact.
• You are a high-trust collaborator who prioritizes team success, actively engaging in Zscaler's challenge culture by giving and receiving respectful feedback to build strong partnerships.
• You are a dedicated learner with a true growth mindset, constantly seeking new insights and feedback to develop your technical skills and better support your teammates.

• Demonstrated curiosity and active exploration of AI tools, with a proven history of integrating new technologies to enhance daily workflows and augment problem-solving
• 4+ years of cybersecurity experience with proven ability to independently investigate and analyze threats, respond to security incidents, and run investigations to completion
• Working knowledge of EDR platforms with hands-on experience in at least two of: CrowdStrike, Microsoft Defender for Endpoint, SentinelOne, Palo Alto Cortex, or CarbonBlack, plus familiarity with Information Security controls across Endpoint, Cloud, SaaS, and Identity environments
• Deep understanding of Windows and macOS operating system internals and network communications, with functional knowledge of Linux systems and strong analytical problem-solving skills
• Excellent written and verbal communication skills with ability to clearly explain complex technical concepts to audiences of varying technical backgrounds, including under pressure

• Foundational knowledge of Digital Forensics and Incident Response (DFIR) processes
• Strong understanding of enterprise technology, network controls, and security operations
• Understanding of current and emerging adversary tactics and techniques, with the ability to practically apply this knowledge in live response scenarios

#LI-remote #LI-JG1