Lead Cybersecurity Detection Engineer

Cybersecurity Jobs; Atlanta (GA); On-site; USD 150,000 - 230,000; Full time

Benefits offered by this job

Health care insurance (medical, dental

Retirement planning (401(k))

Paid days off (sick leave, parental, (

Job summary

Cox Automotive is hiring an onsite Lead Cybersecurity Detection Engineer to strengthen detection across enterprise systems and customer environments. You will design and operate detective capabilities, including AI-driven detection and automation, in partnership with Incident Response, Threat Intelligence, and Vulnerability Management.

This role requires senior technical leadership, multi‑cloud security experience, and expert knowledge of SIEM/EDR/SOAR.

Qualifications

• Bachelor’s degree in Computer Science or a related field and 6+ years of industry experience.
• Multi-cloud security experience with AWS, Azure, and GCP.
• Experience with AI/ML frameworks and prompt engineering for security.
• Expert knowledge of detection engineering and SIEM/SOAR-based use cases.
• Strong background in information security, threat intelligence, and incident response.

Responsibilities

• Lead detection engineering efforts and maintain enterprise detective solutions.
• Architect and deploy agentic AI systems for detection, analysis, and response.
• Design multi-agent frameworks for threat hunting and incident investigation.
• Develop self-improving detection rules and automation playbooks.
• Implement detections using SIEM, EDR, and SOAR platforms.
• Collaborate with Threat Detection and Response teams and Incident Response.
• Validate detections through attack simulation testing and purple team exercises.
• Manage SIEM/Data Lake data ingestion and related infrastructure.
• Ensure compliance with GDPR, PCI-DSS, and NIST controls.
• Maintain documentation and provide off-hours support.

Skills

Multi-cloud security experience

AI/ML frameworks

Prompt engineering

Detection Engineering expertise

SIEM/SOAR

Attack kill chain

Diamond model

Cyber defense experience

Education

Bachelor’s degree in Computer Science or related field

Tools

SIEM

EDR

SOAR

Threat intelligence

Firewalls

SASE

IPS

Endpoint security

DLP

Data Lakes

Job description

Cox Automotive is hiring an onsite Lead Cybersecurity Detection Engineer to strengthen detection across enterprise systems and customer environments. In this role, you will help advance the Detection Engineering team by designing and operating enterprise-grade detective capabilities, including AI-driven detection and automation, while partnering closely with Incident Response, Threat Intelligence, and Vulnerability Management to expand coverage and improve outcomes.

What you’ll do

• Act as a senior technical lead for detection engineering, building and maintaining detective solutions that protect Cox Automotive’s internal systems and domestic and international businesses.
• Contribute to the Detection Engineering strategy, roadmap, and objectives, helping drive execution across the team.
• Architect and deploy agentic AI systems to autonomously detect, analyze, and respond to security threats across enterprise infrastructure.
• Design multi-agent frameworks for threat hunting, incident investigation, and attack pattern recognition.
• Develop self-improving detection systems that learn from investigations and enhance detection rules and playbooks over time.
• Implement advanced detection techniques using SIEM, EDR, and SOAR platforms.
• Create custom detection rules and automated remediation playbooks and alerts aligned to Cox Automotive’s enterprise and customer threat landscape.
• Use MITRE/ATLAS frameworks to assess detection coverage and close gaps.
• Monitor, optimize, and continuously improve detection systems for performance, scalability, and effectiveness.
• Collaborate with the Threat Detection and Response team to improve identification, management, and response capabilities.
• Validate detections through attack simulation testing and support purple teaming exercises with the Vulnerability Management team.
• Manage SIEM/Data Lake data management and log ingestion infrastructure in collaboration with Cyber Defense Engineering counterparts.
• Evaluate, validate, tune, and sunset detections as needed.
• Maintain operational guidelines, diagrams, and documentation for security detection and response activities.
• Provide off‑hour support as needed for security administration, detection, and response activities.
• Partner with Incident Response to accelerate threat identification and containment by building detection logic during incidents.
• Improve detection and response processes based on lessons learned from incidents, and incorporate threat intelligence to proactively mitigate risk.
• Identify emerging threat vectors and integrate them into detection strategies.
• Work with other Cybersecurity, Engineering, and Product teams to deploy detection and response solutions, including customer‑focused implementations.
• Communicate detection capabilities, findings, and technical recommendations to technical and non‑technical stakeholders, escalating to leadership as required.
• Design and implement processes aligned to regulatory requirements and industry standards such as GDPR, PCI‑DSS, and NIST.
• Maintain documentation of detection use cases, processes, and configurations.

What you bring

• Bachelor’s degree in Computer Science or a related discipline and 6+ years of industry related professional experience.
• Multi‑cloud security experience (AWS, Azure, GCP).
• Experience with AI/ML frameworks and prompt engineering for security applications.
• Expert level knowledge of Detection Engineering.
• Strong experience in information security, network security, security monitoring, and Incident Response.
• Strong experience developing SIEM/SOAR detection and automation use cases.
• Working experience with security technologies and services including threat intelligence, firewalls, SASE, IPS, endpoint security, DLP, SIEM/SOAR, and Data Lakes.
• Expert level knowledge of the attack kill chain and diamond model.
• 3+ years experience in a cyber defense role.

Tools and technologies

SIEM, EDR, SOAR, AI/ML, prompt engineering, MITRE, ATLAS, AWS, Azure, GCP, threat intelligence, firewalls, SASE, IPS, endpoint security, DLP, Data Lakes

Benefits

• Health care insurance (medical, dental, vision)
• Retirement planning (401(k))
• Paid days off (sick leave, parental leave, flexible vacation/wellness days, and/or PTO)

Preferred qualifications

• OSCP, GSEC, GCIA, GFE, GCFA, CISA, CISSP, CISM, or CIA certification(s)
• Dev Ops / Engineering / Network / System Administration experience
• Experience developing customer‑focused detection and response systems

Location: Atlanta, GA (onsite)