Cyber Defense Detection & SOAR Engineer (Remote)

Crane NXT, Co.; Northern (KY); Hybrid; USD 100,000 - 180,000; Full time

Job summary

Crane NXT is seeking an experienced Cyber Defense Detection & Automation Engineer to join the Global Information Security Team. The role is hands-on within the SOC, focusing on enhancing SIEM/EDR detections and expanding SOAR-driven automation across a global security operations program.

You will collaborate with SOC analysts to reduce noise, improve alert quality, and drive the maturity of threat hunting. The position covers onboarding, testing, and incident response activities in a fast-paced

Qualifications

• 5+ years of experience in a security operations environment performing investigations and supporting incident response.
• 3+ years of technical experience developing automation, orchestration, or response solutions (e.g., SOAR, scripting, integrations).
• 3+ years of hands-on experience with SIEM platforms, including query languages and log onboarding/integration.
• Experience applying detection/content engineering best practices, including lifecycle management, testing, and tuning.

Responsibilities

• Develop and maintain SOAR automated playbooks for triage, enrichment, and response.
• Manage SOAR integration of security tools and data sources using APIs and orchestration workflows.
• Support ongoing SOAR platform health, reliability, and operational support.
• Design, develop, and maintain SIEM detection content, including correlation rules, alert logic, and enrichment strategies.
• Continuously tune and optimize detections based on SOC feedback, incident learnings, and threat intelligence to improve signal quality and reduce false positives.
• Document detection logic, playbooks, processes, and improvements to ensure consistency, auditability, and scalability.
• Coordinate and execute the SOC threat hunting program, including defining hypotheses, guiding hunts, and operationalizing validated findings into detections.
• Collaborate daily with SOC analysts to refine detections, improve triage workflows, and address gaps in visibility or response.
• Support onboarding of log sources and monitoring capabilities for newly acquired entities, including validating data quality and detection coverage.
• Assist in planning and execution of annual penetration testing, including detection validation and tracking remediation of identified gaps.
• Contribute to incident response activities by providing detection expertise, building rapid-use queries/playbooks, and supporting investigations.
• Engage with business stakeholders to coordinate SOC initiatives, communicate risks and progress, and manage escalations through to resolution.
• Participate in a scheduled on-call rotation, including weekend coverage, to support timely response to security incidents, escalations, and critical operational needs.

Skills

SOAR automation

Python

PowerShell

Automation scripting

SIEM

Threat hunting

Tools

SIEM platforms

APIs

EDR

SOAR platforms

Job description

Crane NXT is seeking an experienced Cyber Defense Detection & Automation Engineer to join the Global Information Security Team. The role is hands-on within the SOC, focusing on enhancing SIEM/EDR detections and expanding SOAR-driven automation across a global security operations program.

You will collaborate with SOC analysts to reduce noise, improve alert quality, and drive the maturity of threat hunting. The position covers onboarding, testing, and incident response activities in a fast-paced