Cybersecurity Engineer III, Detection and Response

Upbound Group Inc.; Plano (TX); On-site; USD 140,000 - 190,000; Full time

Job summary

Upbound Group in Plano, TX is seeking a Cybersecurity Engineer III, Detection and Response to strengthen Security Operations with detection engineering, AI-assisted workflows, and incident response across cloud, identity, endpoint, and SaaS environments.

You will build, test, and maintain reliable monitoring, validate detections against MITRE ATT&CK, lead threat hunts, coordinate containment, and contribute to runbooks and metrics for detection improvements.

Qualifications

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response.
• Hands-on experience with modern SIEM and XDR platforms and detection development.
• Experience with threat hunts across identity, endpoint, cloud, and SaaS environments.
• Experience using AI technologies for security investigations and automation.
• Proficiency with Python, APIs, and security telemetry integrations.
• Knowledge of vulnerability assessment and remediation coordination.

Responsibilities

• Design, develop, test, and tune detections mapped to MITRE ATT&CK and validate effectiveness.
• Build and operate AI-assisted security workflows and playbooks with human oversight.
• Conduct proactive threat hunting across multiple environments to identify gaps.
• Investigate complex incidents and coordinate containment and remediation.
• Engineer and maintain SIEM logging pipelines and telemetry quality.
• Coordinate monitoring requirements with cross-functional teams and runbooks.

Skills

Security operations

Detection engineering

Incident response

Python

APIs

Telemetry integrations

Tools

SIEM

XDR

APIs

Job description

Cybersecurity Engineer III, Detection and Response

Job Purpose:

The Cybersecurity Engineer III, Detection and Response strengthens Upbound's Security Operations capabilities through detection engineering, AI-assisted security operations, incident response, threat hunting, and security telemetry engineering.

This senior technical contributor will build, test, and maintain reliable security monitoring capabilities across cloud, identity, endpoint, network, SaaS, and AI-enabled environments. The engineer will use modern AI technologies as part of daily security operations, applying appropriate validation, data protection safeguards, and human oversight to improve investigative speed and effectiveness.

The position partners with application, infrastructure, cloud, engineering, and product teams to establish security logging requirements, implement reliable ingestion pipelines, develop actionable detections, and assess operational security requirements for new projects and products.

Key Responsibilities:

• Design, develop, test, and tune security detections as code, mapping use cases to MITRE ATT&CK and validating effectiveness through adversary emulation, offensive testing, or controlled simulations.
• Build and operate AI-assisted security workflows, including investigation agents, automated triage, detection development, and response playbooks, with human decision points, accuracy checks, and appropriate data protection safeguards.
• Conduct proactive threat hunting across identity, endpoint, network, cloud, and SaaS environments, using threat intelligence and attacker techniques to identify suspicious activity and detection gaps.
• Independently investigate complex security incidents, including identity-based attacks, and coordinate technical containment, root cause analysis, remediation, and post-incident reviews.
• Engineer and maintain reliable SIEM logging pipelines across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, including ingestion, parsing, normalization, integration troubleshooting, telemetry quality, and logging requirements for new projects and products.
• Validate critical and known-exploited vulnerabilities using assessment results, exploitability information, and system evidence; coordinate remediation verification and implement compensating detections while fixes are underway.
• Partner with application, infrastructure, cloud, product, and managed security teams to assess security monitoring requirements, improve detection quality, operationalize security capabilities, and support technical security reviews.
• Develop security automation, maintain technical documentation and runbooks, and contribute to operational metrics covering detection and containment times, priority detection coverage, automation accuracy, and exploitable exposure age.

Required Qualifications:

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response, with the ability to independently handle complex investigations and develop security detections. Equivalent demonstrated capability will be considered.
• Hands‑on experience with modern SIEM and XDR platforms, including detection development, correlation logic, security query languages, and techniques for testing and tuning detections.
• Practical experience conducting threat hunts and investigating security activity across identity, endpoint, cloud, and SaaS environments, including Microsoft Entra ID, Microsoft 365, AWS, and Azure.
• Demonstrated experience using modern AI technologies for security investigations, detection engineering, or automation, including the ability to validate AI‑generated outputs and recognize their limitations.
• Proficiency with Python, APIs, and security telemetry integrations, including log ingestion, parsing, normalization, and troubleshooting.
• Working knowledge of vulnerability assessment and exploitability validation, with strong analytical, technical documentation, and communication skills for engineering and executive audiences.

Preferred Qualifications:

• Experience with detections as code, source control, automated detection testing, and deployment pipelines.
• Experience developing AI agents, AI‑assisted investigation workflows, or security orchestration and automated response capabilities.
• Familiarity with adversary emulation, purple team exercises, offensive security testing, or threat modeling.
• Experience with infrastructure as code, configuration management, and automated deployment or validation of security integrations.
• Relevant certifications such as CompTIA Security+, GIAC GCIH, GCIA or GCED, Microsoft SC-200, AWS Certified Security – Specialty, or CISSP. Equivalent practical expertise is valued.

Additional Information:

• This position requires onsite presence five days a week (Monday through Friday), subject to HR confirmation.
• Candidates must be authorized to work in the United States without sponsorship, subject to HR confirmation.
• Candidates are encouraged to provide a brief description or example of a security detection, automation, AI‑assisted workflow, or engineering solution they have developed, excluding confidential or proprietary information.

Work Location

Ability to work in the Plano, Texas Monday through Friday, with travel between locations as necessary based on transformation and governance activities.

Employment Eligibility

To be eligible for this opportunity, you must be authorized to work in the U.S. Upbound Group does not offer employment-based immigration sponsorship for this role, including OPT or CPT.

Equal Opportunity Employer

Upbound Group is an equal opportunity employer committed to ensuring all employment decisions are made on a non‑discriminatory basis in accordance with applicable federal, state, and local laws.