Lead Cybersecurity Engineer

American Family Insurance; Madison (WI); Hybrid; USD 113,000 - 194,000; Full time

Benefits offered by this job

Comprehensive medical, dental, vision

Competitive 401(k)

Pension plan

Annual incentive

9 paid holidays

Paid time off (23 days)

Student loan repayment

Paid family leave

Job summary

American Family Insurance is seeking a Lead Cybersecurity Engineer to shape cyber defense capabilities across threat detection, threat hunting, incident response, and adversary simulation. The hybrid role is based in Madison, WI, with occasional work from Boston, MA.

Salary ranges from $113,000 to $194,000 per year, with potential for collaboration across multiple enterprise environments. The role focuses on building scalable security data pipelines, developing automation, and using analytics to

Qualifications

• Customer-driven solutions experience.
• Knowledge of software architectures and deployments.
• Working knowledge of Cyber Security, Cyber Engineering, Computer Science, Software Engineering, and Electrical/Computer Engineering.
• Extensive knowledge of security technologies and application development methodologies.
• Experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.
• Extensive knowledge of directory services and identity stores.

Responsibilities

• Lead design, development, and continuous improvement of cyber defense capabilities.
• Design, build, and maintain scalable security data pipelines ingesting SIEM, EDR, cloud, identity, and threat intel data.
• Develop and optimize security analytics, detections, and threat hunting methodologies.
• Design, implement, and maintain security automation and orchestration using Cortex XSOAR and other SOAR tools.
• Integrate security technologies through APIs and data engineering practices to streamline operations.
• Build reusable automation frameworks and Python scripts to support security operations.
• Conduct proactive threat hunting, adversary emulation, and validation exercises.
• Collaborate with engineering, cloud, infrastructure, identity, and security teams to improve telemetry and resilience.
• Leverage AI-driven security capabilities to enhance detection and automate tasks.
• Evaluate and optimize security monitoring platforms such as Datadog, Microsoft Sentinel, and Splunk.

Skills

Customer-driven solutions

Software architectures

Cyber Security

Cyber Engineering

Computer Science

Software Engineering

Electrical/Computer Engineering

Cyber threat analysis

Incident response

Forensics analysis

Penetration testing

Ethical hacking

Directory services

Identity stores

Tools

Cortex XSOAR

Python

SQL

REST APIs

SIEM

EDR

Datadog

Microsoft Sentinel

Splunk

Job description

American Family Insurance is seeking a Lead Cybersecurity Engineer to help shape and improve cyber defense capabilities across threat detection, threat hunting, incident response, and adversary simulation. The role focuses on building scalable security data pipelines, developing automation and orchestration workflows, and using analytics to strengthen detection and response across enterprise environments.

This hybrid position is based in Madison, WI, with expectations to work a minimum of 10 days per month out of the Boston, MA or Madison, WI offices. The compensation range for this position is $113,000 to $194,000 per year.

What you’ll do

• Lead the design, development, and continuous improvement of cyber defense capabilities spanning threat detection, threat hunting, incident response, and adversary simulation.
• Design, build, and maintain scalable security data pipelines that ingest, normalize, enrich, and analyze data from SIEM, EDR, cloud, identity, and threat intelligence platforms to improve visibility and accelerate threat detection.
• Develop and optimize security analytics, detections, correlation rules, and threat hunting methodologies to identify advanced threats and emerging attack techniques.
• Design, implement, and maintain security automation and orchestration using Cortex XSOAR and other SOAR technologies, including automated investigation, enrichment, response, containment, and remediation workflows.
• Integrate security technologies through APIs, workflow automation, and data engineering practices to streamline operations, reduce manual work, and improve analyst efficiency and response times.
• Build reusable automation frameworks, scripts, and services using Python, REST APIs, SQL/KQL, and other modern development techniques to support security operations and detection programs.
• Conduct proactive threat hunting, adversary emulation, and validation exercises to assess control effectiveness and strengthen detection and response capabilities.
• Collaborate with engineering, cloud, infrastructure, identity, and security teams to improve telemetry quality, data availability, and operational resilience.
• Leverage AI-driven security capabilities and advanced analytics to enhance detection accuracy and automate repetitive tasks.
• Evaluate, implement, and optimize security monitoring and analytics platforms such as Datadog, Microsoft Sentinel, Splunk, and related technologies.
• Provide technical leadership and mentorship for detection engineering, security automation, and threat response initiatives, driving adoption of best practices and continuous improvement.

Required qualifications

• Demonstrated experience providing customer-driven solutions, support, or service.
• Solid knowledge of software engineering architectures, system/software design, and system deployments.
• Working knowledge of relevant disciplines including Cyber Security, Cyber Engineering, Computer Science, Software Engineering, and Electrical/Computer Engineering.
• Extensive knowledge of security technologies and application development methodologies.
• Demonstrated experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.
• Extensive knowledge of directory services and identity stores.

Technologies

• Cortex XSOAR
• Python, SQL, KQL
• REST APIs
• SIEM, EDR
• Datadog, Microsoft Sentinel, Splunk
• MITRE ATT&CK

Preferred qualifications

• Experience building and managing security data pipelines across SIEM, EDR, cloud, identity, and threat intelligence platforms.
• Hands‑on experience with Cortex XSOAR or other SOAR platforms, including playbook and workflow automation.
• Proficiency in Python, SQL/KQL, REST APIs, and security tool integrations.
• Experience with security analytics platforms such as Microsoft Sentinel, Splunk, Datadog, or similar technologies.
• Strong background in detection engineering, threat hunting, and security analytics.
• Experience automating security operations to improve response times and analyst efficiency.
• Knowledge of MITRE ATT&CK, adversary emulation, and threat‑informed defense practices.
• Experience leveraging AI‑driven capabilities to enhance detection, investigation, and response workflows.
• Proven ability to deliver scalable, repeatable security capabilities across engineering and operations teams.
• Experience leading technical initiatives and mentoring cybersecurity engineers.

Benefits

• Comprehensive medical, dental, vision and wellbeing benefits
• Competitive 401(k) contribution
• Pension plan
• Annual incentive
• 9 paid holidays
• Paid time off program (23 days accrued annually for full‑time employees)
• Student loan repayment program
• Paid‑family leave

Additional information

• This role is not eligible for sponsorship.
• Relocation support is offered for eligible candidates.
• Background checks are required for selected candidates.
• Selected candidates must sign a non‑disclosure agreement for proprietary information, trade secrets, and inventions.
• Up to 10% travel may be required.
• Physical requirements: work primarily involves sitting/standing.
• New Employee Orientation is held during the first week for all employees.
• Offer to selected candidate may be contingent on scheduling and availability for in‑person and virtual sessions tied to orientation or related activities.

The company is an equal opportunity employer and considers qualified applicants with criminal histories consistent with applicable law.

If a reasonable accommodation is needed during the application or interview process, contact [e-mail].