Senior Security Engineer- Security Operations

GE Appliances is hiring a Senior Security Engineer to lead Security Operations detection and response engineering for enterprise IT and manufacturing environments.

Responsibilities

• Act as the senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, and operational health; set technical standards used by the MSSP.
• Design, build, test, and maintain detection content including correlation rules, behavioral analytics, and IOC/BIOC rules mapped to MITRE ATT&CK; manage the full detection lifecycle using detection-as-code practices (version control, testing, peer review, documentation).
• Own telemetry coverage by identifying visibility gaps and onboarding, parsing, and normalizing log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.
• Engineer security automation and orchestration (SOAR) playbooks and integrations that enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual effort and MSSP handling time.
• Provide technical oversight of MSSP output in partnership with the Information Security leader owning the MSSP commercial relationship, including:
  • Review triage and investigation quality, escalation accuracy, and run-book adherence.
  • Drive false-positive reduction and tuning.
  • Update MSSP run books and playbooks as detections and the environment change.
• Serve as Tier 3 escalation for complex or high-severity incidents escalated by the MSSP; perform hands-on investigation, endpoint and log analysis, scoping, and containment; coordinate with the external incident response retainer when engaged.
• Lead hypothesis-driven threat hunting informed by threat intelligence and threats targeting manufacturing; convert hunt outcomes into durable detections and hardening recommendations.
• Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions; track relevant threat actors for GE Appliances.
• Validate detection and response effectiveness using purple-team exercises, adversary emulation, and breach-and-attack simulation; measure coverage against MITRE ATT&CK and confirm MSSP detection and response.
• Maintain EDR/XDR platform health across endpoint and server estate, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
• Strengthen vulnerability operations run by the MSSP: scan coverage (including authenticated scanning), risk-based prioritization using exploitability and threat intelligence (e.g., CISA KEV, EPSS), correlate vulnerabilities with active threat activity, and automate remediation workflows.
• Partner with Cloud, Network, and Identity security engineers to integrate cloud security posture (CNAPP), network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
• Partner with OT Security to extend monitoring and detection into manufacturing environments safely for production and consistent with ISA/IEC 62443 and NIST SP 800-82.
• Author and maintain incident response playbooks and technical run books; lead the technical portion of post-incident reviews and drive corrective actions to closure.
• Define, automate, and report operational metrics and KPIs (e.g., MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, MSSP escalation quality) to the CISO and Information Security leadership.
• Contribute to the security operations roadmap by evaluating emerging capabilities (including AI-assisted triage and agentic SOC automation) and supporting platform evaluations, proofs of concept, and TCO analyses.
• Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits; drive remediation of related findings.
• Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.

Requirements

• Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or related technical field, or equivalent practical experience.
• 6–10 years progressive experience in IT or information security, including 4+ years hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
• Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms (e.g., Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike), including writing detection rules/queries (e.g., XQL, SPL, KQL).
• Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
• Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell; working with REST APIs and JSON.
• Hands-on incident response experience with significant enterprise incidents such as ransomware, BEC, and account takeover, including endpoint, log, and network analysis.
• Experience in a technical oversight role working with an MSSP/MDR, including tuning, escalation quality review, and run-book development.
• Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
• Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
• Excellent verbal and written communication skills with the ability to communicate with technical and executive audiences.

Technologies

• Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, CrowdStrike
• XQL, SPL, KQL
• Python, PowerShell, REST APIs, JSON
• MITRE ATT&CK, SOAR, SIEM, EDR, XDR
• Microsoft 365, CNAPP
• CISA KEV, EPSS
• ISA/IEC 62443, NIST SP 800-82, NIST SP 800-61, NIST CSF, CIS Controls
• SOX, C-SOX, PCI-DSS
• Detection-as-code, Git, Sigma, Atomic Red Team, MITRE Caldera

Preferred qualifications

• Certifications: GIAC (GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
• Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
• Experience with threat hunting, purple teaming, and adversary emulation tools (Atomic Red Team, MITRE Caldera, breach-and-attack simulation platforms).
• Familiarity with OT/ICS monitoring frameworks such as ISA/IEC 62443 or NIST SP 800-82.
• Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
• Experience applying AI and large language models to security operations; familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
• Experience in manufacturing, critical infrastructure, or global multinational organizations.

Working conditions

• Normal office environment.
• Occasional weekend and/or evening work; after-hours escalation for major security incidents and participation in an on-call rotation.

Location

• Louisville, KY (onsite), USA