Security Engineer, Lead

Toyota North America; Plano (TX); On-site; USD 120,000 - 180,000; Full time

Benefits offered by this job

Relocation assistance

Tuition reimbursement

Health care plan

Job summary

Toyota Financial Services (TFS) Technology is seeking a Lead Cyber Security Engineer to architect, deploy, and sustain SIEM and SOAR platforms. You will oversee log ingestion, detection content, and automation to empower the SOC and cybersecurity teams.

With a focus on scalable security infrastructure, you will lead engineering efforts across on‑prem, cloud, and hybrid environments while mentoring junior engineers and collaborating with stakeholders across Toyota’s North American teams.

Qualifications

• 5+ years in cyber security engineering with hands-on SIEM administration & SOAR development.
• Proficient with multiple SIEM/SOAR platforms (Splunk, Sentinel, Chronicle, Elastic, XSOAR, Phantom, Swimlane).
• Strong scripting in Python and PowerShell for automation and tooling.
• Excellent communication and ability to influence stakeholders across SOC, infra, and leadership.

Responsibilities

• Lead SIEM engineering, platform health, data onboarding, and log parsing across hybrid environments.
• Design, build, and maintain SOAR playbooks and automation to reduce MTTR and MTTD.
• Deploy and manage security agents across on‑prem, cloud, and hybrid endpoints.
• Develop detection rules, data source integrations, and correlation logic to improve signal-to-noise ratio.
• Create automation tooling with Python/PowerShell and integrate security tools via APIs.
• Develop SOPs, runbooks, and standardized practices for incident response and platform maintenance.

Skills

SIEM administration

SOAR development

Log management

Python

PowerShell

Stakeholder collaboration

Education

Bachelor's degree in Cybersecurity/CS/IT

Tools

Splunk

Microsoft Sentinel

Chronicle

Elastic

Palo Alto XSIAM/XSOAR

Phantom

Swimlane

Job description

Overview

Collaborative. Respectful. A place to dream and do. These are just a few words that describe what life is like at Toyota. As one of the world’s most admired brands, Toyota is growing and leading the future of mobility through innovative, high-quality solutions designed to enhance lives and delight those we serve. We’re looking for talented team members who want to Dream. Do. Grow. with us.

Who we are

An important part of the Toyota family is Toyota Financial Services (TFS), the finance and insurance brand for Toyota and Lexus in North America. While TFS is a separate business entity, it is an essential part of this world-changing company- delivering on Toyota’s vision to move people beyond what’s possible. At TFS, you will help create best-in-class customer experience in an innovative, collaborative environment.

Toyota does not offer support or sponsorship of job applicants for employment-based visas or any other workauthorization for this role now or in the future. You must have the right to work in the United States and not require Toyota support or sponsorship for immigration-related employment (e.g., H-1B, O-1, E-3, H-1B1, TN, F-1 OPT, F-1 STEM, OPT, F-1 CPT, ‘job flexibility benefits’ [also known as I-140 or Adjustment of Status portability], etc.) now or in thefuture. You should not apply for this role if you will require Toyota to assist with immigration support or sponsorshipnow or in the future.

Who we’re looking for

Toyota Financial Services (TFS) Technology team is looking for a highly motivated person to fill a role as a Lead Cyber Security Engineer. Your primary responsibility is to architect, deploy, optimize, and maintain the organization’s Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms. Operating under the Information Security mandate, you will lead engineering efforts to ensure comprehensive log ingestion, detection fidelity, platform health, and automation capabilities that empower the Security Operations Center (SOC) and broader cyber defense teams. We’re looking for someone who thrives in a high-growth environment and brings deep technical expertise alongside strong engineering discipline, enabling you to build scalable, resilient security infrastructure that strengthens Toyota’s detection and response posture.

What you’ll Be doing

SIEM Engineering & Platform Health: Lead the design, configuration, and ongoing maintenance of complex SIEM environments, including onboarding and managing diverse data sources, ensuring proper log parsing, normalization, and enrichment. Proactively monitor platform health, troubleshoot ingestion failures, and optimize storage and performance to maintain operational excellence.

• SOAR Development & Automation : Design, build, and maintain SOAR playbooks and automated workflows that streamline alert triage, enrichment, and response actions. Continuously identify opportunities to reduce manual effort and accelerate mean time to detect (MTTD) and mean time to respond (MTTR) through intelligent automation.
• Agent Deployment & Endpoint Telemetry: Lead the deployment, configuration, and lifecycle management of security agents across on-prem, cloud, and hybrid endpoint environments. Ensure consistent agent coverage, policy enforcement, and telemetry collection to maximize detection visibility across the enterprise.
• Detection Engineering & Data Source Management: Develop and tune detection rules, correlation logic, and alerting thresholds within the SIEM to improve signal-to-noise ratio and detection accuracy. Partner with threat intelligence and SOC teams to translate emerging threats into actionable detection content. Manage the full lifecycle of data source integrations, including scoping, onboarding, validation, and ongoing health monitoring.
• Scripting & Automation Development: Leverage scripting languages such as Python and PowerShell to build custom tooling, automate repetitive engineering tasks, develop API integrations, and enhance platform capabilities beyond out-of-the-box functionality.
• Process Development & Standardization: Assist in the development and maintenance of standard operating procedures (SOPs), engineering runbooks, and documentation that streamline data source onboarding, platform maintenance, and incident support workflows. Continuously refine processes to improve efficiency and consistency.

What you bring

• 5+ years of experience in cyber security engineering, with hands‑on expertise in SIEM administration and engineering, SOAR platform development, log management, data source onboarding, and security agent deployment and lifecycle management.
• Subject matter expertise in one or more SIEM/SOAR platforms (e.g., Splunk, Microsoft Sentinel, Chronicle, Elastic, Palo Alto XSIAM/XSOAR, Phantom, Swimlane, etc.)
• Strong understanding of log source types, parsing methodologies, data normalization techniques, and common log formats (e.g., Syslog, CEF, JSON, XML, Windows Event Logs).
• Proficiency in scripting languages, particularly Python and PowerShell, with demonstrated ability to build automation, custom integrations, and engineering tooling.
• Excellent communication skills with the ability to collaborate with and influence stakeholders at all levels, including SOC analysts, infrastructure teams, and leadership.

Added bonus if you have

• A bachelor’s degree in a relevant field (e.g., Cybersecurity, Computer Science, Engineering, Information Technology) or equivalent work experience.
• Experience in a regulated industry (e.g., finance, healthcare, government).
• Proficiency in additional query and scripting languages (e.g., CQL, SQL, KQL, SPL, EQL, Yara, Bash).
• Experience with security agent platforms such as CrowdStrike Falcon, or Halcyon.
• Proficiency in AWS and Azure cloud environments, with a strong understanding of cloud-native logging, data flows, and access management.
• Experience building and maintaining API-based integrations between security tools and platforms.
• Familiarity with CI/CD pipelines and infrastructure-as-code practices applied to security tooling.
• AWS: AWS Certified Security - Specialty, AWS Certified Solutions Architect - Associate/Professional, AWS Certified SysOps Administrator - Associate
• Azure: Microsoft Certified: Security Operations Analyst Associate (SC-200), Microsoft Certified: Azure Security Engineer Associate (AZ-500), Microsoft Certified: Azure Administrator Associate (AZ-104)
• Cribl: Cribl Certified Observability Engineer (CCOE), Cribl Certified Admin
• CrowdStrike: CrowdStrike Certified Falcon Administrator (CCFA), CrowdStrike Certified Falcon Responder (CCFR), CrowdStrike Certified Falcon Hunter (CCFH)

What we’ll bring

During your interview process, our team can fill you in on all the details of our industry-leading benefits and careerdevelopment opportunities. A few highlights include:

• A work environment built on teamwork, flexibility, and respect
• Professional growth and development programs to help advance your career, as well as tuition reimbursement
• Team Member Vehicle Purchase Discount
• Toyota Team Member Lease Vehicle Program (if applicable)
• Comprehensive health care and wellness plans for your entire family
• Toyota 401(k) Savings Plan featuring a company match, as well as an annual retirement contribution from Toyotaregardless of whether you contribute (if applicable)
• Paid holidays and paid time off
• Referral services related to prenatal services, adoption, childcare, schools and more
• Tax Advantaged Accounts (Health Savings Account, Health Care FSA, Dependent Care FSA)
• Relocation assistance (if applicable)

Belonging at Toyota

Our success begins and ends with our people. We embrace all perspectives and value unique human experiences. Respect for all is our North Star.

Applicants for our positions are considered without regard to race, ethnicity, national origin, sex, sexual orientation, gender identity or expression, age, disability, religion, military or veteran status, or any other characteristics protected by law.