Expert Detection and Response Engineer

Activision Publishing Inc.; Santa Monica (CA); On-site; USD 180,000 - 240,000; Full time

Job summary

Activision Publishing Inc. is seeking an Expert Detection and Response Engineer to identify, investigate, and respond to cybersecurity threats across cloud, corporate, and production environments.

This hands-on role focuses on attacker behavior, rapid analysis, and effective containment within the Global Security Operations team. The role requires strong experience in threat detection, security operations, incident response, and scripting, with the ability to work independently and in on-call

Qualifications

• Bachelor’s degree in computer science, Information Security, or equivalent practical experience.
• 10+ years of security experience with incident response.

Responsibilities

• Detect, investigate, and respond to security incidents across cloud, corporate, and production environments.
• Monitor and analyze telemetry and logs to identify anomalies and threats.
• Perform alert triage, in-depth investigation, and forensic analysis across the incident lifecycle.
• Develop and tune detections within SIEM and EDR.
• Automate investigations and response workflows using scripting.

Skills

Threat detection

Security operations

Incident response

Scripting

Python

PowerShell

KQL

Forensic analysis

Communication

On-call rotation

Education

Bachelor’s degree in computer science or Information Security

Tools

SIEM

EDR

Job description

Job Title: Expert Detection and Response Engineer

Requisition ID: R028213

Job Description: Role Overview

Activision is seeking an Expert Detection and Response Engineer to help protect our players, studios, platforms, and enterprise environments from advanced cyber threats. As part of our Global Security Operations organization, this role is responsible for actively identifying, investigating, and responding to security threats. This role is highly hands‑on and focuses on real‑world attacker behavior, rapid analysis, and effective containment.

• Detect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands‑on member of the TDIR team.
• Monitor and analyze security telemetry and audit logs to identify anomalous activity, unauthorized access, and emerging threats, including targeted attacks and advanced adversaries.
• Perform alert triage, in‑depth investigation, and forensic analysis across the full incident lifecycle, from identification through containment, remediation, and post‑incident review.
• Execute endpoint, identity, cloud, and malware investigations, including timeline reconstruction, indicator extraction, and root cause analysis.
• Develop, refine, and tune threat detections within the SIEM based on real‑world attacker behavior and investigation findings.
• Enhance investigation and response efficiency through automation, SOAR workflows, scripting, and advanced analytics.
• Design, build, or operate AI/LLM-assisted triage and enrichment workflows (e.g., agentic pipelines integrated with case management platforms) to accelerate investigation and reduce analyst toil.
• Evaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict‑poisoning risks introduced via analyzed artifacts, applying schema‑constrained or otherwise bounded output design rather than relying solely on input‑side filtering.
• Contribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics.
• Collaborate closely with engineering teams, business stakeholders, and vendors during active investigations and response efforts.
• Participate in an on‑call rotation and provide off‑hours support for critical incidents and material security events.
• Communicate investigation findings clearly and effectively to technical teams and leadership.
• Occasional travel (up to approximately 10%) may be required to support studios or on‑site incident response.

• Bachelor's degree in computer science, Information Security, or equivalent practical experience. 10+ years of progressively accountable security experience, with a demonstrated track record of independent, expert‑level judgment in incident response.
• Hands‑on experience in threat detection, security operations, and incident response, with active involvement across the full incident lifecycle.
• Strong understanding of the modern threat landscape, attacker tactics, techniques, and procedures.
• Proven ability to detect, triage, investigate, and respond to security incidents in enterprise environments.
• Experience performing detailed log analysis, correlation, and investigative triage.
• Strong written and verbal communication skills, with the ability to clearly articulate incident findings and response actions.
• Ability to work independently and collaboratively within the TDIR team and with technical and business stakeholders.
• Willingness to participate in an on‑call rotation and provide off‑hours support for critical security incidents.
• Hands‑on experience with security monitoring platforms such as SIEM and EDR, including building or significantly extending detection content (not solely tuning existing rules).
• Scripting or programming experience (e.g., Python, PowerShell, KQL) to support detection, investigation, or response automation.
• Strong host- and network‑based forensic skills, including timeline reconstruction and root cause analysis.
• Working knowledge of how LLMs are applied to security operations (alert enrichment, auto‑triage, summarization) and the