Detection & Response Engineer

eBay; Austin (TX); On-site; USD 119,000 - 206,000; Full time

Job summary

eBay is seeking a senior incident response and detection engineer to protect its global marketplace. You will lead investigations across endpoint, cloud, and network domains, building scalable detections and response playbooks while driving automation and threat-informed defense.

This role participates in an on-call rotation and collaborates across teams. Ideal candidates bring 5+ years in security operations, strong scripting in Python, and experience with AWS, Azure, and GCP, plus Kubernetes.

Qualifications

• 5+ years in incident response, detection engineering, threat hunting, or related security field.
• Understanding of adversary TTPs and translating them into detections and mitigations.
• Hands-on experience with cloud and SaaS (AWS, Azure, and GCP) deployments.
• Experience with Kubernetes or containerized environments and cluster telemetry.
• Strong forensics fundamentals and network analysis.
• Scripting or automation in Python or similar language; good communication; on-call rotation.

Responsibilities

• Lead high-impact incident response across intrusions, insider threats, and misuse; tune SIEM detections.
• Investigate complex security events end-to-end using telemetry; drive containment and recovery.
• Apply threat modeling to systems to derive practical telemetry and detection needs.
• Hunt for attacker behavior; identify visibility gaps; build playbooks and detective controls.
• Develop automation and tooling, including AI-assisted workflows for safe, auditable responses.

Skills

Incident response

Detection engineering

Threat hunting

Cloud/SaaS experience

Kubernetes/Container telemetry

Python scripting

Communication

On-call rotation

Tools

Kubernetes

Job description

At eBay, we're more than a global ecommerce leader — we’re changing the way the world shops and sells. Our platform empowers millions of buyers and sellers in more than 190 markets around the world. We’re committed to pushing boundaries and leaving our mark as we reinvent the future of ecommerce for enthusiasts.

Our customers are our compass, authenticity thrives, bold ideas are welcome, and everyone can bring their unique selves to work — every day. We're in this together, sustaining the future of our customers, our company, and our planet.

Join a team of passionate thinkers, innovators, and dreamers — and help us connect people and build communities to create economic opportunity for all.

About The Team And The Role

The Detection & Response team helps protect eBay’s global marketplace by identifying, investigating, and responding to cyber threats across a sophisticated technology environment. This role sits at the center of high-impact security work, partnering closely with the SOC, Global Technology engineering, People Team, Legal, and other security teams to reduce risk and strengthen resilience across the company.

As a senior individual contributor, you will work across endpoint, identity, cloud, Kubernetes/container, and network environments to investigate advanced threats, improve detections, and help compose scalable response capabilities. This is an opportunity to influence how eBay detects and responds to modern adversaries, while contributing to automation, threat-informed defense, and continuous improvement across the security program. This role participates in an on‑call rotation.

What You Will Accomplish

• Lead high‑impact incident response across a wide range of scenarios, including external intrusions, insider threats, and misuse, helping contain risk and restore business operations quickly and optimally. Improve eBay’s ability to detect and respond to threats by building, tuning, and maintaining SIEM detections and alert logic that increase coverage while reducing false positives.
• Investigate complex security events end‑to‑end by reconstructing activity from telemetry, identifying root cause, and driving containment, eradication, and recovery with multi‑functional partners.
• Apply threat modeling to new systems, infrastructure, and features, translating security risks into practical telemetry, detection, and response requirements for engineering teams.
• Proactively hunt for attacker behavior, surface visibility gaps, and turn adversary research into actionable countermeasures, playbooks, and detective controls that strengthen long‑term defense.
• Develop automation and tooling, including AI‑or​‑agent‑assisted workflows, to streamline enrichment, triage, evidence collection, and response actions in ways that are safe, auditable, and scalable.

What You Will Bring

• 5+ years of experience in incident response, detection engineering, threat hunting, or a closely related security field, with a track record of leading investigations and improving response operations.
• Strong understanding of modern adversary tactics, techniques, and procedures, capable of translating them into practical detections, mitigations, and response strategies.
• Hands‑on experience across cloud and SaaS environments, with the ability to develop detection approaches that can scale across platforms such as AWS, Azure, and GCP.
• Experience working in Kubernetes or containerized environments, including using cluster telemetry to investigate activity and identify common attack paths or failure patterns.
• Proven network and digital forensics fundamentals, including analyzing network traffic and applying forensically sound practices during active investigations.
• Scripting or automation experience in Python or a similar language, along with strong communication skills and the flexibility to participate in an on‑call rotation.

Additional Details

The base pay range for this position is expected in the range below:

$118,800 - $205,600

Base pay offered may vary depending on multiple individualized factors, including location, skills, and experience. The total compensation package for this position may also include other elements, including a target bonus and restricted stock units (as applicable) in addition to a full range of medical, financial, and/or other benefits (including 401(k) eligibility and various paid time off benefits, such as PTO and parental leave). Details of participation in these benefit plans will be provided if an employee receives an offer of employment.

If hired, employees will be in an “at‑will position” and the Company reserves the right to modify base salary (as well as any other discretionary payment or compensation program) at any time, including for reasons related to individual performance, Company or individual department/team performance, and market factors.

Remote roles are not eligible for U.S. visa sponsorship.

eBay is an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, national origin, sex, sexual orientation, gender identity, veteran status, and disability, or other legally protected status. If you have a need that requires accommodation, please contact us at [e-mail]. We will make every effort to respond to your request for accommodation as soon as possible. View our accessibility statement to learn more about eBay's commitment to ensuring digital accessibility for people with disabilities. It is unlawful in Massachusetts to require or administer a lie detector test as a condition of employment or continued employment. An employer who violates this law shall be subject to criminal penalties and civil liability.

We use cookies to enhance your experience and may use AI tools for administrative tasks in the hiring process. To learn how we handle your personal data and use AI responsibly, please visit our Talent Privacy Notice, Privacy Center and AI Hiring Guidelines.