Lead Engineer - Incident Response Engineering

Target Target · Retail · NCD-0375 Brooklyn Park, MN

Lead Engineer for Incident Response Engineering team, focusing on developing and maturing user and entity behavior analytics (UEBA) capabilities for insider risk detection and user risk assessment. The role involves designing, building, and enhancing internal applications, services, and workflows, contributing to SOAR and artifact collection platforms, and evaluating new technologies. Requires expertise in software engineering patterns, problem-solving, and collaboration with security operations and cross-functional teams.

What you'd actually do

  1. Use your technology acumen to apply and maintain knowledge of current and emerging technologies within specialized areas of the technology domain
  2. Design, build, and enhance internal applications, services, and workflows that support insider risk detection, user risk assessment, and incident response operations
  3. Help mature and become the subject matter expert for an internally developed UEBA capability, including detection workflows, enrichment, scoring, and analyst-facing investigation experiences
  4. Contribute across the broader Incident Response Engineering portfolio, including SOAR, artifact collection, and related internal platforms
  5. Evaluate new technologies and participate in decision-making, accounting for factors such as viability within Target’s technical environment, maintainability, and cost of ownership

Skills

Required

  • 4 year degree or equivalent experience
  • 5+ years of software development experience with at least one full cycle implementation from requirement to production
  • Strong problem solving and thought partnership skills
  • Demonstrated sense of ownership and the ability to work with a limited set of requirements
  • Expertise in frontend and backend development
  • Expertise in JavaScript or TypeScript, React, and Python
  • Experience designing and integrating REST APIs and web-based services
  • Experience building internal applications, workflow systems, or analyst-facing tools
  • Ability to navigate ambiguity and contribute across multiple Incident Response Engineering tools and platforms

Nice to have

  • Experience with SOAR platforms or security automation tools
  • Experience with UEBA, insider risk, behavioral analytics, or detection engineering
  • Familiarity with PostgreSQL or similar relational databases
  • Familiarity with identity and access patterns, including RBAC and Active Directory / LDAP integrations
  • Familiarity with data pipelines or data-processing workflows

What the JD emphasized

  • insider risk detection
  • user risk assessment
  • behavioral signals
  • scoring
  • workflow-driven analysis
  • SOAR
  • artifact collection
  • UEBA
  • detection engineering