Cybersecurity Engineer III, Detection and Response

Acima; Plano (TX); Presencial; USD 120.000 - 180.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Onsite five days a week

Descripción de la vacante

Upbound Group seeks a Cybersecurity Engineer III, Detection and Response to strengthen security operations in Plano, TX. The role focuses on detection engineering, AI-assisted investigations, incident response, and telemetry engineering across cloud, identity, endpoint, network, SaaS, and AI-enabled environments.

You will partner with product and infrastructure teams to establish logging requirements, ingest pipelines, and actionable detections, while validating effectiveness through emulation

Formación

• Five or more years of relevant experience in security operations, detection engineering, and incident response.
• Hands-on experience with modern SIEM and XDR platforms and detection development.
• Experience with threat hunts across identity, endpoint, cloud, and SaaS environments (AWS/Azure/M365).
• Demonstrated ability to validate AI-assisted outputs and integrate security telemetry.
• Proficiency with Python, APIs, and security telemetry integrations.

Responsabilidades

• Design, develop, test, and tune security detections as code aligned to MITRE ATT&CK.
• Build AI-assisted security workflows with controlled human decision points.
• Conduct proactive threat hunting across multiple environments.
• Independently investigate complex incidents and coordinate remediation.
• Engineer and maintain SIEM/XDR logging pipelines and telemetry ingestion.
• Validate vulnerabilities and coordinate remediation verification.
• Collaborate with teams to improve monitoring requirements and detections.
• Develop automation, runbooks, and operational security metrics.

Conocimientos

SIEM/XDR platforms

Threat hunting

Python

APIs & telemetry

Cloud platforms (AWS/Azure)

Educación

Bachelor's degree in CS or related field

Herramientas

Microsoft Entra ID

Microsoft 365

AWS

Azure

CI/CD tooling

Descripción del empleo

Job Description:

Cybersecurity Engineer III, Detection and Response

Job Purpose:

The Cybersecurity Engineer III, Detection and Response strengthens Upbound’s Security Operations capabilities through detection engineering, AI-assisted security operations, incident response, threat hunting, and security telemetry engineering.

This senior technical contributor will build, test, and maintain reliable security monitoring capabilities across cloud, identity, endpoint, network, SaaS, and AI-enabled environments. The engineer will use modern AI technologies as part of daily security operations, applying appropriate validation, data protection safeguards, and human oversight to improve investigative speed and effectiveness.

The position partners with application, infrastructure, cloud, engineering, and product teams to establish security logging requirements, implement reliable ingestion pipelines, develop actionable detections, and assess operational security requirements for new projects and products.

Key Responsibilities:

• Design, develop, test, and tune security detections as code, mapping use cases to MITRE ATT&CK and validating effectiveness through adversary emulation, offensive testing, or controlled simulations.

• Build and operate AI-assisted security workflows, including investigation agents, automated triage, detection development, and response playbooks, with human decision points, accuracy checks, and appropriate data protection safeguards.

• Conduct proactive threat hunting across identity, endpoint, network, cloud, and SaaS environments, using threat intelligence and attacker techniques to identify suspicious activity and detection gaps.

• Independently investigate complex security incidents, including identity-based attacks, and coordinate technical containment, root cause analysis, remediation, and post-incident reviews.

• Engineer and maintain reliable SIEM logging pipelines across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, including ingestion, parsing, normalization, integration troubleshooting, telemetry quality, and logging requirements for new projects and products.

• Validate critical and known‑exploited vulnerabilities using assessment results, exploitability information, and system evidence; coordinate remediation verification and implement compensating detections while fixes are underway.

• Partner with application, infrastructure, cloud, product, and managed security teams to assess security monitoring requirements, improve detection quality, operationalize security capabilities, and support technical security reviews.

• Develop security automation, maintain technical documentation and runbooks, and contribute to operational metrics covering detection and containment times, priority detection coverage, automation accuracy, and exploitable exposure age.

Required Qualifications:

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response, with the ability to independently handle complex investigations and develop security detections. Equivalent demonstrated capability will be considered.

• Hands‑on experience with modern SIEM and XDR platforms, including detection development, correlation logic, security query languages, and techniques for testing and tuning detections.

• Practical experience conducting threat hunts and investigating security activity across identity, endpoint, cloud, and SaaS environments, including Microsoft Entra ID, Microsoft 365, AWS, and Azure.

• Demonstrated experience using modern AI technologies for security investigations, detection engineering, or automation, including the ability to validate AI‑generated outputs and recognize their limitations.

• Proficiency with Python, APIs, and security telemetry integrations, including log ingestion, parsing, normalization, and troubleshooting.

• Working knowledge of vulnerability assessment and exploitability validation, with strong analytical, technical documentation, and communication skills for engineering and executive audiences.

Preferred Qualifications:

• Experience with detections as code, source control, automated detection testing, and deployment pipelines.
• Experience developing AI agents, AI‑assisted investigation workflows, or security orchestration and automated response capabilities.
• Familiarity with adversary emulation, purple team exercises, offensive security testing, or threat modeling.
• Experience with infrastructure as code, configuration management, and automated deployment or validation of security integrations.
• Relevant certifications such as CompTIA Security+, GIAC GCIH, GCIA or GCED, Microsoft SC-200, AWS Certified Security – Specialty, or CISSP. Equivalent practical expertise is valued.

Additional Information:

• This position requires onsite presence five days a week (Monday through Friday), subject to HR confirmation.
• Candidates must be authorized to work in the United States without sponsorship, subject to HR confirmation.
• Candidates are encouraged to provide a brief description or example of a security detection, automation, AI‑assisted workflow, or engineering solution they have developed, excluding confidential or proprietary information.

Work Location

Ability to work in the Plano, Texas Monday through Friday, with travel between locations as necessary based on transformation and governance activities.

Employment Eligibility

To be eligible for this opportunity, you must be authorized to work in the U.S. Upbound Group does not offer employment-based immigration sponsorship for this role, including OPT or CPT.

Equal Opportunity Employer

Upbound Group is an equal opportunity employer committed to ensuring all employment decisions are made on a non-discriminatory basis in accordance with applicable federal, state, and local laws.

Upbound Group is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees.