Incident Responder 1

Job overview

The Incident Responder 1 role is hybrid preferred, with remote work considered, in the USA; the listing location is Philadelphia, PA. Compensation is not specified. The role is part of Bentley Systems’ Information Security team and Security Operations Center, supporting a global engineering and SaaS environment across three public clouds. The responder validates automated investigations, handles cases that automation cannot resolve, and takes approved containment actions. Findings are fed back into detections, playbooks, and automation so the SOC can improve response quality and coverage.

What you'll do

• Monitor and respond to SIEM, SOAR, endpoint, and cloud security alerts, including automated investigation output
• verify verdicts and confirm, close, escalate, or contain cases within approved limits
• investigate inconclusive cases and document outcomes
• hand off incidents across shifts
• sample automated verdicts for accuracy
• tune detections and playbooks
• monitor tooling health and raise coverage gaps
• contribute to detection-as-code and playbook testing
• participate in post-incident reviews and propose automation improvements.

What we're looking for

Skills & competencies

incident response

security operations center

siem

soar

crowdstrike

wiz

cloud security

detection engineering

hybrid preferred

remote considered

philadelphia pa

bentley systems

Work arrangement

• Weekend coverage required

Benefits & perks

• Training and certifications are funded.

Why this role

Entry-level role requiring 1–2 years of security-related education or training, or equivalent IT experience. Requires availability for a shift rotation in a 24×7 operation; no travel is required. Applicants must be authorized to work in the U.S. without current or future employer sponsorship.

About the employer

Bentley Systems is hiring for this role. Industry: Software Publishers. Sector: 51.