Cybersecurity Engineer III, Detection and Response

Upbound Field Support Center Rent A Center Texas LP; United States; On-site; USD 130,000 - 170,000; Full time

Job summary

Upbound Group's Plano, TX Security Operations team seeks a Cybersecurity Engineer III, Detection and Response, to advance our detection engineering, AI-assisted operations, and incident response capabilities.

You will implement reliable detections across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, partnering with engineering and product teams to define logging requirements and build robust ingestion pipelines.

Qualifications

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response.
• Hands‑on experience with modern SIEM and XDR platforms, including detection development and tuning.
• Threat hunts and investigations across identity, endpoint, cloud, and SaaS environments (Microsoft Entra ID, Microsoft 365, AWS, Azure).
• Experience using AI technologies for security investigations, detection engineering, or automation.
• Proficiency with Python, APIs, and security telemetry integrations.

Responsibilities

• Design, develop, test, and tune security detections as code, mapped to MITRE ATT&CK.
• Build and operate AI-assisted security workflows and response playbooks with human checks.
• Conduct proactive threat hunting across multiple environments.
• Coordinate containment, root cause analysis, and remediation during complex incidents.
• Maintain SIEM logging pipelines and ensure telemetry quality for new projects.
• Validate vulnerabilities and coordinate remediation verification while fixes are applied.
• Collaborate with security and product teams to improve monitoring requirements.

Skills

Security operations

Detection engineering

Incident response

Threat hunting

Python

APIs

Security telemetry

Executive communication

Tools

SIEM platforms

XDR platforms

Microsoft Entra ID

AWS

Azure

Job description

Job Purpose

The Cybersecurity Engineer III, Detection and Response strengthens Upbound's Security Operations capabilities through detection engineering, AI-assisted security operations, incident response, threat hunting, and security telemetry engineering. This senior technical contributor will build, test, and maintain reliable security monitoring capabilities across cloud, identity, endpoint, network, SaaS, and AI-enabled environments. The engineer will use modern AI technologies as part of daily security operations, applying appropriate validation, data protection safeguards, and human oversight to improve investigative speed and effectiveness. The position partners with application, infrastructure, cloud, engineering, and product teams to establish security logging requirements, implement reliable ingestion pipelines, develop actionable detections, and assess operational security requirements for new projects and products.

Key Responsibilities

• Design, develop, test, and tune security detections as code, mapping use cases to MITRE ATT&CK and validating effectiveness through adversary emulation, offensive testing, or controlled simulations.
• Build and operate AI-assisted security workflows, including investigation agents, automated triage, detection development, and response playbooks, with human decision points, accuracy checks, and appropriate data protection safeguards.
• Conduct proactive threat hunting across identity, endpoint, network, cloud, and SaaS environments, using threat intelligence and attacker techniques to identify suspicious activity and detection gaps.
• Independently investigate complex security incidents, including identity-based attacks, and coordinate technical containment, root cause analysis, remediation, and post-incident reviews.
• Engineer and maintain reliable SIEM logging pipelines across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, including ingestion, parsing, normalization, integration troubleshooting, telemetry quality, and logging requirements for new projects and products.
• Validate critical and known-exploited vulnerabilities using assessment results, exploitability information, and system evidence; coordinate remediation verification and implement compensating detections while fixes are underway.
• Partner with application, infrastructure, cloud, product, and managed security teams to assess security monitoring requirements, improve detection quality, operationalize security capabilities, and support technical security reviews.
• Develop security automation, maintain technical documentation and runbooks, and contribute to operational metrics covering detection and containment times, priority detection coverage, automation accuracy, and exploitable exposure age.

Required Qualifications

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response, with the ability to independently handle complex investigations and develop security detections. Equivalent demonstrated capability will be considered.
• Hands‑on experience with modern SIEM and XDR platforms, including detection development, correlation logic, security query languages, and techniques for testing and tuning detections.
• Practical experience conducting threat hunts and investigating security activity across identity, endpoint, cloud, and SaaS environments, including Microsoft Entra ID, Microsoft 365, AWS, and Azure.
• Demonstrated experience using modern AI technologies for security investigations, detection engineering, or automation, including the ability to validate AI-generated outputs and recognize their limitations.
• Proficiency with Python, APIs, and security telemetry integrations, including log ingestion, parsing, normalization, and troubleshooting.
• Working knowledge of vulnerability assessment and exploitability validation, with strong analytical, technical documentation, and communication skills for engineering and executive audiences.

Preferred Qualifications

• Experience with detections as code, source control, automated detection testing, and deployment pipelines.
• Experience developing AI agents, AI‑assisted investigation workflows, or security orchestration and automated response capabilities.
• Familiarity with adversary emulation, purple team exercises, offensive security testing, or threat modeling.
• Experience with infrastructure as code, configuration management, and automated deployment or validation of security integrations.
• Relevant certifications such as CompTIA Security+, GIAC GCIH, GCIA or GCED, Microsoft SC-200, AWS Certified Security – Specialty, or CISSP. Equivalent practical expertise is valued.

Additional Information

This position requires onsite presence five days a week (Monday through Friday), subject to HR confirmation.

Candidates must be authorized to work in the United States without sponsorship, subject to HR confirmation.

Candidates are encouraged to provide a brief description or example of a security detection, automation, AI‑assisted workflow, or engineering solution they have developed, excluding confidential or proprietary information.

Work Location

Ability to work in the Plano, Texas Monday through Friday, with travel between locations as necessary based on transformation and governance activities.

Employment Eligibility

To be eligible for this opportunity, you must be authorized to work in the U.S. Upbound Group does not offer employment-based immigration sponsorship for this role, including OPT or CPT.

Equal Opportunity Employer

Upbound Group is an equal opportunity employer committed to ensuring all employment decisions are made on a non‑discriminatory basis in accordance with applicable federal, state, and local laws.

Upbound Group is an equal opportunity employer.

We celebrate diversity and are committed to creating an inclusive environment for all employees.

Upbound Group, Inc. (NASDAQ: UPBD) is a technology and data‑driven leader in accessible and inclusive financial solutions that address the evolving needs and aspirations of underserved customers. The Company’s customer‑facing operating units include industry‑leading brands such as Acima, Brigit, and Rent‑A‑Center that facilitate consumer transactions across a wide range of store‑based and digital channels, including over 2,300 company branded retail units across the United States, Mexico, and Puerto Rico.