Cybersecurity Detection & Response Engineer

Old National Bank; Chicago (IL); On-site; USD 78,000 - 153,000; Full time

Benefits offered by this job

Medical insurance

Dental insurance

Vision insurance

401(k) plan

Continuing education

Employee assistance program

Job summary

Old National Bank is seeking a Cybersecurity Detection and Response Engineer to lead security monitoring and response with a focus on Microsoft Sentinel and Defender XDR. You will develop detections, automate workflows, and support complex investigations across the SOC to improve speed and accuracy.

The role emphasizes collaboration with SOC, IT, and third parties, plus continuous improvement of telemetry and playbooks to advance security operations while supporting governance and regulatory

Qualifications

• Bachelor’s degree or equivalent experience in cybersecurity, IT, or CS.
• Minimum 4 years of cybersecurity experience including monitoring or incident response.
• Experience with Microsoft Sentinel and Defender XDR.
• Strong KQL, and ability to develop detection logic and dashboards.
• Scripting or automation experience (PowerShell, Python, APIs, Logic Apps).
• Familiarity with MITRE ATT&CK, endpoint security, and regulated environments.

Responsibilities

• Develop and maintain detection use cases based on threat intel and MITRE ATT&CK.
• Conduct validation testing, threat hunting, and red/purple-team exercises.
• Identify gaps and improve telemetry, coverage, and response processes.
• Partner with SOC analysts, IT, and third parties to improve investigations.
• Design and maintain Sentinel playbooks, Logic Apps, and automation workflows.
• Automate repetitive SOC processes to speed response and consistency.
• Support incident response with data analysis, evidence collection, and documenting learnings.
• Continuously improve monitoring, response, and AI-assisted workflows.

Skills

KQL

PowerShell

Python

APIs

Logic Apps

Education

Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or equivalent experience

Tools

Microsoft Sentinel

Microsoft Defender XDR

Logic Apps

Job description

Old National Bank has been serving clients and communities since 1834. With over $70 billion in total assets, we are a regional powerhouse deeply rooted in the communities we serve. As a trusted partner, we thrive on helping our clients achieve their goals and dreams, and we are committed to social responsibility and investing in our communities through volunteering and charitable giving.

We continually seek highly motivated and talented individuals as our people are critical to our success. In return, we offer competitive compensation with our salary and incentive program, in addition to medical, dental, and vision insurance. 401K, continuing education opportunities and an employee assistance program are also included in our benefit suite. Old National also offers a variety of Impact Network Groups led by team members who are passionate about driving engagement, creating awareness of diverse backgrounds and experiences, and building inclusion across the organization. We offer a unique opportunity to join a growing, community and client-focused company that is firmly rooted in its core values.

Responsibilities

The Cybersecurity Detection and Response Engineer administers , engineers, and improves ONB's security monitoring and response platforms, with primary focus on Microsoft Sentinel and Microsoft Defender XDR. This role builds and tunes detections, supports complex investigations, partners with third-party monitoring providers to receive and triage escalations, automates repeatable security workflows, and uses modern tools—including AI-assisted analysis—to improve speed, accuracy, and consistency across security operations.

Salary Range

The salary range for this position is $77,900/yr - $153,000/yr plus bonus. The base salary indicated for this position reflects the compensation range applicable to all levels of the role across the United States. Actual salary offers within this range may vary based on a number of factors, including the specific responsibilities of the position, the candidate’s relevant skills and professional experience, educational qualifications, and geographic location.

Key Accountabilities

Detection Engineering & Threat Detection

• Develop and maintain detection use cases based on threat intelligence, emerging attack techniques, and MITRE ATT&CK.
• Conduct validation testing, threat hunting, and participate in red/ purple-team testing to evaluate detection effectiveness.
• Identify monitoring gaps and implement improvements to coverage, telemetry, and response processes.
• Partner with SOC analysts, IT teams, and third-party providers to improve investigation quality and operational outcomes.

Security Automation & SOAR

• Design and maintain Sentinel playbooks, Logic Apps, APIs, and automation workflows.
• Automate repetitive SOC processes to improve response speed, consistency, and analyst efficiency.
• Evaluate and responsibly apply AI-assisted capabilities to support investigation, summarization, triage, detection development, and operational improvement.

Incident Response Support

• Serve as an escalation resource for complex security events and investigations.
• Support incident response through data analysis, evidence collection, and investigative support.
• Maintain practical playbooks, response procedures, and after-action improvement recommendations.

Continuous Improvement

• Research emerging threats, vulnerabilities, defensive capabilities, and practical uses of AI in security operations.
• Support audit, regulatory, and governance needs including FFIEC, NIST, and applicable banking requirements.
• Continuously improve monitoring, response, automation, and operational processes.

Key Competencies for Position

• Technical depth: Strong understanding of Sentinel, Defender XDR, KQL, detection engineering, automation, and incident response.
• Investigative judgment: Able to analyze complex events, identify root cause , and develop practical risk-based improvements.
• Communication and partnership: Clearly explains technical issues and works effectively across security, IT, risk, and business teams.
• Continuous improvement mindset: Seeks opportunities to improve security operations through automation, AI-assisted workflows, and better detection outcomes.

Qualifications & Education Requirements

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent experience.
• Minimum 4 years of cybersecurity experience, including security monitoring, incident response, or detection engineering.
• Experience administering Microsoft Sentinel and Microsoft Defender XDR technologies.
• Strong KQL skills and experience developing detection logic, dashboards, or hunting queries.
• Experience with scripting or automation such as PowerShell, Python, APIs, Logic Apps, or similar tools.
• Working knowledge of MITRE ATT&CK, endpoint security, log analysis, and regulated security environments.
• Interest in responsibly using AI-assisted tools to improve security operations, investigation, automation, and documentation.

Preferred Qualifications

• SC-200, AZ-500, CISSP, GCIH, GCIA, GCFA, or equivalent certifications.
• Experience in banking, financial services, or other regulated industries where security programs must be measured, documented, tested, and audit-defensible.
• Practical experience using AI-assisted tools to accelerate investigation, summarize security data, generate or refine detection logic, improve documentation, or support automation workflows.
• Hands-on experience with security automation, orchestration, AI-assisted analysis, or response technologies.

Key Measures of Success / Key Deliverables

• Improves detection accuracy, reduces false-positive volume, and strengthens SOC visibility.
• Develops and maintains high-quality Sentinel detections, Defender XDR improvements, workbooks, dashboards, and automation workflows.
• Supports timely response to security events and complex investigations.
• Operationalizes new telemetry, monitoring capabilities, and AI-assisted efficiencies where appropriate .
• Proactively communicates status, risks, obstacles, and recommendations to leadership and stakeholders.

Old National is proud to be an equal opportunity employer focused on fostering an inclusive workplace and committed to hiring a workforce comprised of diverse backgrounds, cultures and thinking styles.

As such, all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, national origin, protected veteran status, status as a qualified individual with disability, sexual orientation, gender identity or any other characteristic protected by law.

We do not accept resumes from external staffing agencies or independent recruiters for any of our openings unless we have an agreement signed by the Director of Talent Acquisition, SVP, to fill a specific position.

Our culture is firmly rooted in our core values.

We are optimistic. We are collaborative. We are inclusive. We are agile. We are ethical.

We are Old National Bank. Join our team!