Detection and Automation Engineer - Skechers

OpenTalent; Manhattan Beach (CA); On-site; USD 140,000 - 200,000; Full time

Job summary

OpenTalent in Manhattan Beach, CA is seeking a security detection engineer to source, integrate, and analyze log and event data to build insights, detections, and dashboards. You will prioritize and tune detection logic based on threat intelligence and adversary behavior, and document results and procedures.

Responsibilities include expanding telemetry quality, driving threat hunting and purple-team activities, and developing security automation playbooks using deterministic actions and

Qualifications

• Advanced experience with event log management, aggregation, alerting, and monitoring.
• Experience developing, tuning, testing, and documenting detection rules and alerts.
• Experience with SOAR automation platforms, APIs, webhooks, and scripting languages (Python/PowerShell).
• Deep understanding of identity and access management, network architecture, and systems hardening in a large heterogeneous environment.
• Experience with Windows, Linux, and macOS servers/workstations.
• Strong cloud experience (AWS, Azure, GCP) is a plus.

Responsibilities

• Source, integrate, and leverage log and event data to create insights and develop detections, and dashboards.
• Prioritize, develop, test, tune, and maintain detection logic, rules, and alerts based on threat intelligence and adversary behavior.
• Develop and maintain documentation of detection logic, data requirements, and response procedures.
• Improve telemetry quality by evaluating source integrations, parsing, normalization, and logging practices.

Skills

Event log management

Detection rules & alerts

SOAR automation

Python/PowerShell scripting

IAM knowledge

Cross-platform servers

Cloud services (AWS/Azure/GCP)

Tools

SOAR platforms

Job description

WHAT YOU'LL DO:

• Source, integrate, and leverage log and event data to create insights and develop queries, detections, and dashboards
• Prioritize, develop, test, tune, and maintain detection logic, rules, and alerts based on threat intelligence, attack techniques, and knowledge of adversary behavior
• Develop and maintain clear documentation of detection logic, data requirements, test results, tuning decisions, alert handling, and response procedures
• Improve the quality and usability of security telemetry by evaluating source integrations, parsing, normalization, enrichment, field mappings, and logging practices to ensure the data supports effective detection and investigation.
• Drive regular threat hunting and purple team exercises and translate findings into measurable detection and response improvements
• Design, build, and continuously improve security automation playbooks that blend deterministic actions with AI-assisted analysis and actions
• Manage and maintain the security tools and supporting infrastructure used for log processing, detection engineering, orchestration, and response automation
• Triage alerts and reports received from various sources and perform incident response in real time as needed
• Evaluate, deploy, and maintain innovative security tools, technology, and systems
• Collaborate to define cybersecurity standards and develop secure procedures
• Work closely with multiple global groups and business units to provide guidance and support
• Perform regular security and vulnerability reviews and participate in periodic security and compliance audits
• Stay current with the changing threat landscape, detection engineering and automation practices, AI capabilities and limitations, and defensive technologies.

WHAT YOU'LL BRING:

• Advanced experience with event log management, aggregation, alerting, and monitoring
• Demonstrated experience developing, tuning, testing, and documenting detection rules and alerts, with working knowledge of adversary tactics, techniques, and procedures.
• Experience with SOAR or similar automation platforms, APIs, webhooks, and scripting languages such as Python or PowerShell
• Deep understanding of security concepts relating to identity and access management, network architecture, and systems hardening in a large heterogeneous environment
• Experience working with servers and workstations running Windows, Linux, and macOS
• Strong experience with public cloud services (AWS, Azure, GCP) a plus
• Excels in developing and maintaining effective working relationships while remaining focused on the task at hand
• Ability to excel in a fast-paced and rapidly changing environment
• Strong analytical and problem-solving skills, with attention to detail and the ability to follow evidence