Cyber Defense: SOAR & Detection Automation Engineer

Crane NXT; United States; On-site; USD 120,000 - 150,000; Full time

Job summary

Crane NXT is seeking an experienced Cyber Defense Detection & Automation Engineer to join the Global Information Security Team in the United States. The role focuses on engineering detection across SIEM/EDR, expanding SOAR automation, and maturing the SOC threat hunting program.

You will collaborate with SOC analysts, improve alert quality, and support penetration testing, onboarding of new logs, and incident response initiatives within a global security program.

Qualifications

• 5+ years of experience in a security operations environment performing investigations and supporting incident response.
• 3+ years of technical experience developing automation, orchestration, or response solutions (e.g., SOAR, scripting, integrations).
• 3+ years of hands-on experience with SIEM platforms, including query languages and log onboarding/integration.

Responsibilities

• Develop and maintain SOAR automated playbooks for triage, enrichment, and response.
• Manage SOAR integration of security tools and data sources using APIs and orchestration workflows.
• Support ongoing SOAR platform health, reliability, and operational support.
• Design, develop, and maintain SIEM detection content, including correlation rules, alert logic, and enrichment strategies.
• Continuously tune and optimize detections based on SOC feedback, incident learnings, and threat intelligence to improve signal quality and reduce false positives.
• Document detection logic, playbooks, processes, and improvements to ensure consistency, auditability, and scalability.
• Coordinate and execute the SOC threat hunting program, including defining hypotheses, guiding hunts, and operationalizing validated findings into detections.
• Collaborate daily with SOC analysts to refine detections, improve triage workflows, and address gaps in visibility or response.
• Support onboarding of log sources and monitoring capabilities for newly acquired entities, including validating data quality and detection coverage.
• Assist in planning and execution of annual penetration testing, including detection validation and tracking remediation of identified gaps.
• Contribute to incident response activities by providing detection expertise, building rapid-use queries/playbooks, and supporting investigations.
• Engage with business stakeholders to coordinate SOC initiatives, communicate risks and progress, and manage escalations through to resolution.
• Participate in a scheduled on-call rotation, including weekend coverage, to support timely response to security incidents, escalations, and critical operational needs.

Skills

SOAR

Scripting

SIEM

Python

PowerShell

Threat hunting

Tools

APIs

Job description

Crane NXT is seeking an experienced Cyber Defense Detection & Automation Engineer to join the Global Information Security Team in the United States. The role focuses on engineering detection across SIEM/EDR, expanding SOAR automation, and maturing the SOC threat hunting program.

You will collaborate with SOC analysts, improve alert quality, and support penetration testing, onboarding of new logs, and incident response initiatives within a global security program.