Principal Cybersecurity Incident Response Engineer

About this role:

Wells Fargo is seeking a Principal Engineer in Technology as part of Cybersecurity. Learn more about the career areas and lines of business at wellsfargojobs.com.

The Tier 3 Principal Cybersecurity Incident Response Engineer serves as a senior technical escalation point for complex, high impact, and potentially enterprise significant cybersecurity incidents. The role provides advanced investigation, containment, remediation, and technical leadership while helping mature incident response capabilities across the organization. Tier 3 operates beyond initial triage and investigation, focusing on incidents requiring deeper technical analysis, cross functional coordination, and development of repeatable detection and response capabilities.

In this role, you will:

• Lead technical investigation of complex and high severity cybersecurity incidents; determine scope, attack path, affected assets, and potential business impact
• Serve as an escalation point for Tier 1 and Tier 2 analysts; provide technical guidance for responders during complex investigations
• Develop containment, eradication, and recovery recommendations; coordinate technical response activities with security, infrastructure, application, and other appropriate teams
• Support major incident and crisis response activities when required
• Correlate information across endpoint, network, identity, cloud, application, and security telemetry; perform advanced analysis to identify attacker behaviors, persistence mechanisms, lateral movement, and indicators of compromise
• Apply threat intelligence and attacker tactics, techniques, and procedures to active investigations; translate investigative findings into actionable detection and response opportunities
• Identify gaps exposed through incidents and investigations; develop or recommend new detection logic, investigative techniques, response procedures, and automation opportunities
• Partner with engineering and security platform teams to improve visibility and response effectiveness; help operationalize new cybersecurity technologies and capabilities
• Mentor analysts and facilitate knowledge transfer; develop investigation playbooks, documentation, and reusable analytical methods; provide technical leadership without requiring formal people management responsibilities
• Participate in tabletop exercises, simulations, after action reviews, and root cause analysis; translate lessons learned into measurable improvements in processes, technology, telemetry, and response procedures; evaluate emerging technologies and techniques that could strengthen incident response capabilities
• Demonstrate proficiency in using AI‑assisted development and analysis tools (e.g., GitHub Copilot and approved code‑centric agents)
• Leverage AI to accelerate system design, coding, testing, analysis, and troubleshooting
• Apply strong technical judgment when validating and integrating AI‑assisted outputs into solutions
• Understand and account for model limitations, security risks, and operational considerations
• Apply AI responsibly in development and production environments
• Ensure AI usage aligns with security, compliance, privacy, and ethical standards

Required Qualifications:

• 7+ years of Engineering experience, or equivalent demonstrated through one or a combination of the following: work experience, training, military experience, education

Desired Qualifications:

• Experience leading Incident Response during major incidents
• Experience with enterprise incident response and security operations
• Experience investigating incidents with endpoint detection and response (EDR) and extended detection and response (XDR) tools
• Experience with security information and event management (SIEM) tools and large scale log analysis
• Knowledge and understanding of network and endpoint forensics
• Experience with identity and authentication investigations
• Experience with cloud security investigations
• Knowledge and understanding of malware analysis and attacker tactics, techniques, and procedures
• Knowledge and understanding of the MITRE ATT&CK framework
• Experience with threat intelligence
• Experience with detection engineering and threat hunting
• Experience with scripting or automation for security investigations
• Experience with major incident and ransomware response
• Ability to take ownership of technically ambiguous problems
• Ability to drive investigations from initial escalation through resolution
• Ability to communicate complex technical findings clearly to technical and nontechnical stakeholders
• Ability to influence teams without relying on positional authority
• Ability to mentor less experienced responders
• Ability to turn individual incidents into broader improvements in defensive capability
• Ability to engage effectively with cybersecurity engineering, technology, risk, and external security partners
• Ability to navigate and express confidence to the larger team during high stress situations

Posting End Date:

*Job posting may come down early due to volume of applicants.

We Value Equal Opportunity

Wells Fargo is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, status as a protected veteran, or any other legally protected characteristic.

Employees support our focus on building strong customer relationships balanced with a strong risk mitigating and compliance-driven culture which firmly establishes those disciplines as critical to the success of our customers and company. They are accountable for execution of all applicable risk programs (Credit, Market, Financial Crimes, Operational, Regulatory Compliance), which includes effectively following and adhering to applicable Wells Fargo policies and procedures, appropriately fulfilling risk and compliance obligations, timely and effective escalation and remediation of issues, and making sound risk decisions. There is emphasis on proactive monitoring, governance, risk identification and escalation, as well as making sound risk decisions commensurate with the business unit’s risk appetite and all risk and compliance program requirements.

Candidates applying to job openings posted in Canada: Applications for employment are encouraged from all qualified candidates, including women, persons with disabilities, aboriginal peoples and visible minorities. Accommodation for applicants with disabilities is available upon request in connection with the recruitment process.

Applicants with Disabilities

To request a medical accommodation during the application or interview process, visit Disability Inclusion at Wells Fargo.

Drug and Alcohol Policy

Wells Fargo maintains a drug free workplace. Please see our Drug and Alcohol Policy to learn more.

Wells Fargo Recruitment and Hiring Requirements:

a. Third-Party recordings are prohibited unless authorized by Wells Fargo.

b. Wells Fargo requires you to directly represent your own experiences during the recruiting and hiring process.

c. Please be prepared to provide accurate information and supporting documentation in connection with any lawful employment and education verification conducted by Wells Fargo.