Lead Cybersecurity Engineer (Hybrid)

American Family Insurance Group; Madison (WI); Hybrid; USD 113,000 - 194,000; Full time

Benefits offered by this job

401(k) contribution

Pension plan

Annual incentive

9 paid holidays

Paid time off (23 days)

Student loan repayment program

Paid-family leave

New Employee Orientation

Job summary

American Family Insurance Group is seeking a Lead Cybersecurity Engineer to drive security operations engineering and automation in a hybrid role across Madison, WI and Boston, MA. You will design scalable data pipelines, detections, and adversary emulation to strengthen defenses, while leading automation via Cortex XSOAR and integrating tools across SIEM/EDR/cloud environments.

You will mentor teams, advance security analytics, and leverage AI capabilities to improve detection accuracy and

Qualifications

• Experience delivering customer‑driven security solutions and services.
• Strong background in cyber threat analysis, incident response, and forensics.
• Hands‑on with security data pipelines and data engineering across SIEM/EDR/cloud/identity.

Responsibilities

• Lead design and continuous improvement of cyber defense capabilities across detection, hunting, incident response and adversary emulation.
• Build scalable security data pipelines ingesting SIEM/EDR/cloud/identity data to improve visibility.
• Develop detections, correlations, and threat hunting methods for advanced threats.
• Design and maintain automation/orchestration using Cortex XSOAR with automated investigations.
• Integrate security tools via APIs to streamline operations and improve analyst efficiency.
• Mentor detection engineering and security automation teams and promote best practices.

Skills

Python

SQL/KQL

REST APIs

Threat hunting

Detection engineering

Security analytics

Automation

SOAR

Tools

Cortex XSOAR

Datadog

Microsoft Sentinel

Splunk

Job description

Lead Cybersecurity Engineer (Hybrid)### Lead Cybersecurity Engineer (Hybrid)Apply: Hybrid: WI Madison: MA Boston: Full time: Posted Yesterday: End Date: November 20, 2026 (7 days left to apply): R39580American Family Insurance is seeking a Lead Cybersecurity Engineer to drive the engineering and automation of next-generation security operations. In this hands-on leadership role, you'll build scalable security solutions through data engineering, detection engineering, and SOAR orchestration, leveraging technologies such as Cortex XSOAR, Python, SQL/KQL, REST APIs, and leading security analytics platforms. You'll lead automation initiatives, integrate security tools, and develop repeatable detection and response capabilities that improve analyst efficiency and strengthen our overall security posture. You will report to the Senior Manager Cybersecurity - Cyber Threat Defense. This role is NOT eligible for sponsorship. #LI-HybridPosition Compensation Range:$113,000.00 - $194,000.00Pay Rate Type:Salary*Compensation may vary based on the job level and your geographic work location.* *Relocation support is offered for eligible candidates.* **Primary Accountabilities:** * Lead the design, development, and continuous improvement of cyber defense capabilities across threat detection, threat hunting, incident response, and adversary simulation activities.* Design, build, and maintain scalable security data pipelines that ingest, normalize, enrich, and analyze data from SIEM, EDR, cloud, identity, and threat intelligence platforms to improve visibility and accelerate threat detection.* Develop and optimize security analytics, detections, correlation rules, and threat hunting methodologies to identify advanced threats and emerging attack techniques across enterprise environments.* Design, implement, and maintain security automation and orchestration capabilities using Cortex XSOAR and other SOAR technologies, including automated investigation, enrichment, response, containment, and remediation workflows.* Integrate security technologies through APIs, workflow automation, and data engineering practices to streamline operations, reduce manual effort, and improve analyst efficiency and response times.* Build and maintain reusable automation frameworks, scripts, and services using Python, REST APIs, SQL/KQL, and other modern development techniques to support security operations and threat detection programs.* Conduct proactive threat hunting, adversary emulation, and validation exercises to assess security control effectiveness and strengthen organizational detection and response capabilities.* Collaborate with engineering, cloud, infrastructure, identity, and security teams to improve telemetry quality, data availability, and operational resilience across the cybersecurity ecosystem.* Leverage AI-driven security capabilities and advanced analytics to enhance detection accuracy, automate repetitive tasks, and improve security operations effectiveness.* Evaluate, implement, and optimize security monitoring and analytics platforms, such as Datadog, Microsoft Sentinel, Splunk, and related technologies, ensuring scalable and sustainable security operations.* Provide technical leadership and mentorship for detection engineering, security automation, and threat response initiatives while driving adoption of best practices and continuous improvement. **Specialized Knowledge & Skills Requirements:** * Demonstrated experience providing customer-driven solutions, support, or service.* Solid knowledge and understanding of software engineering architectures, system/software designs, and system deployments.* Working knowledge of Cyber Security, Cyber Engineering, Computer Science, Software Engineering, and Electrical/Computer Engineering.* Extensive knowledge and understanding of security technologies and application development methodologies.* Demonstrated experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.* Extensive knowledge and understanding of directory services and identity stores. **Preferred Qualifications** * Experience building and managing security data pipelines across SIEM, EDR, cloud, identity, and threat intelligence platforms.* Hands-on experience with **Cortex XSOAR** or other SOAR platforms, including playbook and workflow automation.* Proficiency in **Python**, **SQL/KQL**, **REST APIs**, and security tool integrations.* Experience with security analytics platforms such as **Microsoft Sentinel**, **Splunk**, **Datadog**, or similar technologies.* Strong background in **detection engineering**, threat hunting, and security analytics.* Experience automating security operations to improve response times and analyst efficiency.* Knowledge of **MITRE ATT&CK**, adversary emulation, and threat-informed defense practices.* Experience leveraging **AI-driven capabilities** to enhance detection, investigation, and response workflows.* Proven ability to deliver scalable, repeatable security capabilities across engineering and operations teams.* Experience leading technical initiatives and mentoring cybersecurity engineers. Licenses: * Not Applicable. Travel Requirements * Up to 10%. Physical Requirements * Work that primarily involves sitting/standing. Working Conditions * Not Applicable.### Additional Information* To ensure a strong start, all employees participate in our New Employee Orientation during their first week. This experience is held in person at our Madison, WI Headquarters or one of our AmFam core locations to help you connect with our mission, meet key team members and build relationships that support your growth. At times, sessions may be delivered virtually based on scheduling and availability.* Offer to selected candidate will be made contingent on the results of applicable background checks* Offer to selected candidate is contingent on signing a non-disclosure agreement for proprietary information, trade secrets, and inventions* Sponsorship will not be considered for this position unless specified in the posting In this hybrid role you will be expected to work a minimum of 10 days per month out of the Boston, MA or Madison, WI officies.We provide benefits that support your physical, emotional, and financial wellbeing. You will have access to comprehensive medical, dental, vision and wellbeing benefits that enable you to take care of your health. We also offer a competitive 401(k) contribution, a pension plan, an annual incentive, 9 paid holidays and a paid time off program (23 days accrued annually for full-time employees). In addition, our student loan repayment program and paid-family leave are available to support our employees and their families. Interns and contingent workers are not eligible for American Family Insurance Group benefits.We are an equal opportunity employer. It is our policy to comply with all applicable federal, state and local laws pertaining to non-discrimination, non-harassment and equal opportunity. We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law.American Family Insurance is committed to the full inclusion of all qualified individuals. If a reasonable accommodation is needed to participate in the job application or interview process, to perform essential job functions, and/or to receive other benefits and privileges of employment, please email [e-mail] to request a reasonable accommodation.