Threat and Incident Response Engineer

Volanno is seeking two Threat and Incident Response Engineers to support the information security team at Sound Transit, the regional transit authority serving the Puget Sound area. The work spans the corporate IT network and the operational technology that runs transit systems. Time is split about evenly between responding to security incidents and proactive threat hunting, with detection tuning running underneath both.

On the incident side, this role owns alerts from the moment they arrive. That means triage out of SIEM, EDR, NDR, and the OT monitoring platform, then analysis, escalation, and guidance on containment, eradication, and recovery. This team member will write the root cause analyses and incident reports that go to Sound Transit leadership, keep incident metrics current, and build out response playbooks. In the OT environment the work also involves reading industrial network traffic and coordinating directly with plant and engineering staff, since a response step that is routine on a corporate network can take something offline that needs to stay running.

On the hunting side, this team member will form hypotheses and test them against endpoint, network, log, and OT protocol telemetry. What the hunts turn up becomes new detection content. Coverage is mapped against MITRE ATT&CK to guide where hunts focus next, and threat intelligence feeds back into the following round.

Alert quality runs through both halves of the job. Detection tuning is a standing part of the role, so expect meaningful time on rule tuning, suppression logic, correlation and enrichment, and SOAR automation.

This position will function within a highly motivated, dynamic team. We are looking for someone who works calmly during an active incident and who takes the initiative on hunting rather than waiting for work to be assigned.