Incident Responder I, Detection & Automation Oversight (Hybrid)

Job overview

Incident Responder I, Detection & Automation Oversight is a hybrid role, with Philadelphia, Pennsylvania preferred; home-based arrangements may be considered for exceptional candidates where business needs permit. Compensation is not specified. The role is part of Bentley’s Information Security team and Security Operations Center. The responder will review automated security investigations, handle cases requiring human judgment, and take approved containment actions. By improving detections, playbooks, and automation based on case outcomes, the role helps protect Bentley’s global engineering and SaaS environment.

What you'll do

• Monitor and respond to SIEM, SOAR, endpoint, and cloud security alerts
• review automated verdicts and confirm, escalate, or contain cases within approved limits
• investigate inconclusive cases and document outcomes
• hand off incidents across shifts
• sample automated verdicts for accuracy
• tune detections and playbooks
• monitor security tooling health
• contribute to detection-as-code and post-incident reviews
• flag abnormal AI-agent activity.

What we're looking for

Skills & competencies

incident responder i

detection

automation oversight

hybrid

philadelphia pa

bentley systems

security operations center

siem

soar

crowdstrike

wiz

detection-as-code

shift rotation

u.s. work authorization required

Work arrangement

• Weekend coverage required

Benefits & perks

• Training and certifications are funded
• Bentley Impact Day
• colleague recognition programs
• inclusion, belonging, and wellbeing initiatives.

Why this role

Entry-level role with a defined development path into detection engineering, security engineering, architecture, or governance; shift rotation supports a 24×7 operation.

About the employer

Bentley Systems is hiring for this role. Industry: Software Publishers. Sector: 51.