Blackstone

Blackstone

Alert, Detection, and Response Engineer, Associate - Blackstone Cybersecurity

Miami · Mid

Sponsorship not specified$110k-$170kDetected 17 hours ago
PythonPowerShellCode ReviewGitAWSGCPAzureCloud PlatformsLLMsAgentic AICybersecuritySIEMMicrosoft SentinelMicrosoft DefenderKQLSOARSOC OperationsDetection EngineeringIncident ResponseSalesFirewallVoIPMentoringWriting

Stay score

odds of building a lasting career here

59Sponsors, lottery-bound
Cap-exempt (no lottery)0
Sponsors this role100
Entry-level history0
PERM / green-card track0
Lottery odds (Level III)83
Fits your clock70

Sponsors, but it's cap-subject — you still face the weighted lottery (~45% per draw at Level III). Good if you win; have a cap-exempt backup on your list.

Lottery odds assume a STEM candidate.

Personalize to your clock →

Employer immigration record

from this employer's Department of Labor filings

Green-card filing pattern in this occupation

Context, not a finding about this posting: of this employer's 14 green-card filings in this occupation, 100% were for a worker who already held the job.

Green-card follow-through: 82%

Of 11 labor certifications old enough to have been used, 2 expired without the employer filing the next step. Median time from filing to decision: 484 days.100% of their filings were for a worker who already held the job.Only certifications past the 180-day window are counted — recent ones cannot have expired yet.

Files H-1B transfers

20 transfer filings in the last year, covering 20 workers. Median labor-condition decision: 7 days. An employer that already files transfers is one that can take over an existing H-1B.

Sourced from Department of Labor LCA, PERM and prevailing-wage disclosure data. Employer matching is by name, so figures may be split across an employer's legal entities. Absence of a filing means none appears in our copy of the data, not that none exists.

Community outcomes

No reports yet — be the first to help the next applicant.

About the role

  • Blackstone Technology & Innovations (BXTI) is the technology team at the core of each of Blackstone's businesses and new growth initiatives.
  • We are problem solvers who can take projects from idea to implementation.
  • We are critical to the firm maintaining its competitive edge.

Responsibilities

  • Manage an incident queue, carrying cases from intake through investigation, containment, and closure across, but not limited to, email, endpoint, identity, network, and cloud
  • Investigate email threats end to end, covering phishing, business email compromise, and malicious attachments and links, using header and message trace analysis to scope who was targeted and drive remediation across affected mailboxes
  • Author and tune detections from investigation findings, developing the logic and validating it against historical and live data, then taking it through review into production and confirming afterward that it fires on real activity without generating unacceptable noise
  • Document investigations and incidents to a standard that holds up under scrutiny, maintain evidence handling and chain of custody, and communicate findings clearly to technical teams and senior stakeholders
  • Advising on marketing plans prepared by a sales team or developing and/or contributing information for marketing materials.
  • Blackstone seeks to deliver compelling returns for institutional and individual investors by strengthening the companies in which the firm invests.

Requirements

  • 2+ years of hands-on experience in security operations, incident response, or a comparable technical security role
  • Hands-on SIEM experience with experience writing and troubleshoot your own queries
  • experience with a major enterprise SIEM and its native query language (for example Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
  • experience with a leading EDR platform (for example CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint)
  • Working knowledge of cloud and identity investigation, including cloud audit logging, IAM, and SSO, and identity providers such as Okta or Microsoft Entra ID
  • Familiarity with the security technologies an investigation touches: email security, endpoint protection, proxies and firewalls, DLP, and vulnerability data
  • Working knowledge of MITRE ATT&CK and experience mapping observed activity to technique
  • Experience scripting in Python and/or PowerShell for enrichment, parsing, and automation of repetitive analysis
  • Experience self-organizing, prioritizing under time pressure, and staying accurate during a live incident
  • The Associate must have strong working knowledge of incident response procedures, the technology used to execute them, as well as an understanding of how to leverage AI tools effectively.
  • Demonstrated experience running security investigations end to end, from alert through root cause and containment, in a SOC or IR setting
  • Hands-on SIEM experience with experience writing and troubleshoot your own queries; experience with a major enterprise SIEM and its native query language (for example Splunk/SPL, Microsoft Sentinel/KQL, or Elastic)
  • Hands-on EDR experience conducting endpoint investigation and containment; experience with a leading EDR platform (for example CrowdStrike, SentinelOne, or Microsoft Defender for Endpoint)
  • Practical understanding of attacker behavior across the intrusion lifecycle, including phishing and business email compromise, credential theft, privilege escalation, lateral movement, persistence, and exfiltration
  • Demonstrated hands-on use of AI tooling in real work, with experience speaking in detail about several projects, professional or otherwise, where you used AI to automate or accelerate a task, and sound judgment about where its output cannot be trusted
  • Clear technical writing, with experience explaining an incident and its impact to both engineers and non-technical stakeholders

Nice to have

  • Detection engineering experience: authoring or tuning SIEM correlation searches, EDR custom rules, or Sigma content, and measuring whether a detection actually works
  • Experience with detection-as-code practices, including Git-based workflows, peer review, and CI validation of detection content
  • SOAR automation experience (Torq, Splunk SOAR, Tines, or similar)
  • Digital forensics capability in memory, disk, or network analysis, or hands-on malware triage and sandboxing
  • Experience with agentic AI or LLM-assisted security tooling, and with AI security monitoring platforms
  • Threat hunting experience, particularly hypothesis-driven hunts against endpoint or cloud telemetry
  • Working knowledge of at least one major cloud platform (AWS, Azure, or GCP), including how its logging, identity, and access services are used to investigate activity in the environment
  • Experience in financial services or another heavily regulated, globally distributed environment

Compensation

  • $110,000 - $170,000
  • Actual base salary within that range will be determined by several components including but not limited to the individual's experience, skills, qualifications and job location.
  • For roles located outside of the US, please disregard the posted salary bands as these roles will follow a separate compensation process based on local market comparables.
  • Additional compensation and benefits offered in connection with the role consist of comprehensive health benefits, including but not limited to medical, dental, vision, and FSA benefits; paid time off; life insurance; 401(k) plan; and discretionary bonuses.
  • Certain employees may also be eligible for equity and other incentive compensation at Blackstone's sole discretion.
  • This policy applies to all terms and conditions of employment, including but not limited to hiring, placement, promotion, termination, transfer, leave of absence, compensation, and training.

Benefits

  • Blackstone's over $1.3 trillion in assets under management include global investment strategies focused on real estate, private equity, credit, infrastructure, life sciences, growth equity, secondaries and hedge funds.
  • Work alongside agentic AI investigation tooling on first-pass triage and enrichment, judging its conclusions, escalating what it gets wrong, and feeding corrections back so coverage improves

Equal opportunity

  • If you need a reasonable accommodation to complete your application, please contact Human Resources at 212-583-5000 (US), +44 (0)20 7451 4000 (EMEA) or +852 3656 8600 (APAC).

Visa & Work Authorization

  • nd applicants for employment without regard to race, color, creed, religion, sex, pregnancy, national origin, ancestry, citizenship status, age, marital or partnership status, sexual orientation, gender identity or expre
Apply directly at Blackstone →Create a free account for alerts like thisView Blackstone immigration profile

This listing is sourced directly from Blackstone's careers page and normalized into a canonical job model.