Cybersecurity Engineer II

Cox Automotive is seeking a Cybersecurity Engineer II to strengthen the customer security program by identifying, analyzing, and defending against threats that can impact both Cox Automotive and its customers. The role supports fraud investigations and collaborates with business, product, and cybersecurity teams to expand protective capabilities using advanced technologies and AI-driven support.

Responsibilities

• Investigate and respond to threats including account takeover, credential abuse, phishing, and fraud, with support for fraud investigations and forensic activities.
• Provide after-hours support as needed to support response activities.
• Partner with business, Product, and Cybersecurity teams to reduce customer impact and improve threat response effectiveness.
• Assist with projects to implement technologies and controls designed to prevent and identify malicious behavior and customer-impacting fraud.
• Operate security tools and platforms including SIEM and log analytics, SOAR, threat intelligence, EDR, email protection, cloud security, IDS/IPS, and Zero Trust technologies.
• Perform threat analysis using industry-standard frameworks such as MITRE ATT&CK, kill chain, and diamond model.
• Investigate suspected account compromise by reviewing authentication, API, and application logs to reconstruct attacker activity and identify other affected customers.
• Use AI-based tools to accelerate investigation, triage, and problem solving.
• Use AI and automation to streamline SOC processes and improve threat detection, including detection logic and fraud signals.
• Translate threat findings into new detections and protections to enhance the customer security program.
• Propose and assist with review of security plans, policies, and customer protections.
• Maintain metrics, playbooks, and documentation for the customer security program, including fraud trend information.
• Produce threat intelligence and fraud reports for security, business, and product stakeholders.
• Monitor emerging threats, fraud schemes, and AI-driven attack techniques targeting customers, and act quickly to protect customers and the enterprise.
• Assist with investigation and resolution of security events and incidents.

Requirements

• Bachelor’s degree in a related discipline and 2+ years of experience in a related field; or a different combination such as a master’s degree and up to 2 years of experience; or 14 years of experience in a related field.
• Hands-on experience in threat intelligence and incident response.
• Hands-on experience with industry-standard security technologies such as firewalls, VPN, IDS/IPS, SASE, secure web proxy, EDR/XDR, SIEM, and SOAR.
• Strong digital forensics and analytical problem-solving skills.
• Working knowledge of major cloud platforms, including AWS, Azure, and GCP, with awareness of architectures and native security services.
• Proficiency with query and scripting languages such as SPL, KQL, Python, and PowerShell for threat hunting, analysis, and automation.

Technologies

• SIEM, log analytics, SOAR, threat intelligence
• EDR, email protection, cloud security, IDS/IPS
• Zero Trust technologies
• MITRE ATT&CK, kill chain, diamond model
• AI-based tools, AI and automation
• SASE, secure web proxy
• EDR/XDR
• Firewalls, VPN
• AWS, Azure, GCP
• SPL, KQL, Python, PowerShell

Benefits

• Health care insurance (medical, dental, vision)
• Retirement planning (401(k))
• Paid days off (sick leave, parental leave, flexible vacation/wellness days, and/or PTO)

Location

Atlanta, GA (onsite)