Remote Security Operations Engineer II - Cyber Defense

Credit Acceptance Corporation

Oregon

Hybrid

USD 102,000 - 142,000

Full time

5 days ago

Be an early applicant

Get a reply from this employer

Your resume and cover letter, tailored to exactly what they’re hiring for.

Get past ATS filters

Benefits offered by this job

401(K) match

Adoption assistance

Parental leave

Tuition reimbursement

Medical/dental/vision benefits

Job summary

Credit Acceptance Corporation is seeking a cybersecurity engineer to join our remote-first security team. You will operate, maintain, and improve enterprise Cyber Defense platforms, triage alerts, and support containment actions across on-prem and cloud environments.

Join a team that emphasizes engineering excellence, ownership, and collaboration. The role offers a hybrid work model with occasional travel to regional offices and opportunities to advance in security architecture and automation.

Qualifications

Bachelor's degree in computer science, information systems, cybersecurity, or related field, or equivalent practical experience.
Minimum 2 years of experience in cybersecurity engineering, security operations, incident response, or a related technical field.
Experience triaging cybersecurity alerts or incidents and supporting approved containment actions.
Hands-on experience supporting enterprise security platforms in SIEM, EDR, secure web access, WAF, automation, or detection engineering.
Experience using a scripting or automation language and APIs, webhooks, or structured configuration files.
Experience with version control and Infrastructure as Code concepts.
Working knowledge of cloud services and cloud security logs.
Understanding of secure authentication, credential handling, and least-privilege access.
Knowledge of incident response, common attacker techniques, and established cybersecurity frameworks.
Ability to troubleshoot across multiple technologies and produce clear technical documentation.
Candidates must reside in or be willing to relocate to one of the following hub locations: the greater Southfield, Michigan, area; the greater Bellevue, Washington, area; or the San Francisco Bay Area, California.

Responsibilities

Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services.
Maintain next-generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, or data-quality issues.
Maintain endpoint detection and response capabilities; support investigations and approved containment actions.
Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues.
Support web application protections with network and application teams; help implement rules, logging, integrations, and approved exceptions.
Perform initial triage of cybersecurity alerts and incidents; gather evidence, document findings, determine scope, and escalates as needed.
Support approved containment, remediation, and recovery actions across enterprise and cloud environments.
Develop and tune detection logic to improve signal quality and investigative value.
Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.
Use Infrastructure as Code, version control, testing, and change-management practices to maintain approved Cyber Defense resources.
Use AI-assisted workflows to improve analysis and efficiency while applying access controls, testing, human oversight, and audit requirements.
Monitor platform health; maintain technical documentation; share knowledge; and participate in security projects and the on-call rotation.