Lead Cybersecurity Detection Engineer

Lead Cox Automotive’s Detection Engineering efforts by designing, building, and continuously improving enterprise and customer security detections, including AI-driven capabilities.

Responsibilities

• Act as a senior technical lead for detection engineering, creating and maintaining detective solutions that protect Cox Automotive internal systems and domestic and international businesses
• Support execution of the Detection Engineering strategy, roadmap, and objectives
• Architect and deploy agentic AI systems to autonomously detect, analyze, and respond to security threats across enterprise infrastructure
• Design multi-agent frameworks for threat hunting, incident investigation, and attack pattern recognition
• Build self-improving detection systems that learn from investigations and enhance detection rules and playbooks automatically
• Design and implement advanced threat detection techniques using SIEM, EDR, and SOAR platforms
• Develop custom detection rules, automated remediation playbooks, and alerts aligned to Cox Automotive’s enterprise and customer threat landscape
• Use MITRE/ATLAS frameworks to assess detection coverage and identify and close gaps
• Continuously monitor, optimize, and improve detection systems for performance, scalability, and effectiveness
• Partner with the Threat Detection and Response team to improve identification, management, and response capabilities efficiently and effectively
• Validate detection use cases through attack simulation testing
• Collaborate with Vulnerability Management to conduct purple teaming exercises
• In collaboration with Cyber Defense Engineering, manage and maintain SIEM/Data Lake data management and log ingestion infrastructure
• Evaluate, validate, tune, and sunset detections as needed
• Maintain operational guidelines, diagrams, and documentation for security detection and response
• Provide off-hour support when required for security administration, detection, and response activities
• Work with Incident Response to enable rapid detection and containment
• Build threat detection logic during incident response to accelerate threat identification and containment
• Improve detection and response processes based on lessons learned from incidents
• Leverage threat intelligence to strengthen detection capabilities and proactively mitigate risks
• Identify and analyze new and emerging threat vectors and integrate them into detection strategies
• Coordinate with Cybersecurity, Engineering, and Product teams to ensure successful deployment of detection and response solutions
• Collaborate with Product teams to design and implement customer-focused detection and response solutions
• Communicate detection capabilities, findings, and technical recommendations to technical and non-technical stakeholders, escalating to leadership as needed
• Design and implement processes that align with regulatory requirements and industry standards (e.g., GDPR, PCI-DSS, NIST)
• Document detection use cases, processes, and configurations

Requirements

• Bachelor’s degree in Computer Science or related discipline plus 6+ years of industry related professional experience
• Multi-cloud security experience with AWS, Azure, and GCP
• Experience with AI/ML frameworks and prompt engineering for security applications
• Expert level knowledge of Detection Engineering
• Strong experience in information security, network security, security monitoring, and Incident Response
• Strong experience developing SIEM/SOAR detection and automation use cases
• Working knowledge of security technologies and services including threat intelligence, firewalls, SASE, IPS, endpoint security, DLP, SIEM/SOAR, and Data Lakes
• Expert level knowledge of the attack kill chain and diamond model
• 3+ years experience in a cyber defense role

Technologies

• SIEM, EDR, SOAR
• AI/ML, prompt engineering
• MITRE, ATLAS, MITRE/ATLAS frameworks
• AWS, Azure, GCP
• Threat intelligence, firewalls, SASE, IPS
• Endpoint security, DLP, Data Lakes

Benefits

• Health care insurance (medical, dental, vision)
• Retirement planning (401(k))
• Paid days off (sick leave, parental leave, flexible vacation/wellness days, and/or PTO)

Preferred Qualifications

• OSCP, GSEC, GCIA, GFE, GCFA, CISA, CISSP, CISM, or CIA certification(s)
• Dev Ops / Engineering / Network / System Administration experience
• Experience developing customer-focused detection and response systems