Security Operations Engineer II

Credit Acceptance Corporation; Southfield (MI); Remote; USD 85,000 - 124,000; Full time

Benefits offered by this job

401K match

Parental leave

Tuition reimbursement

Medical/Dental/Vision insurance

Job summary

Credit Acceptance Corporation is seeking a Security Operations Engineer II to engineer, operate, and automate capabilities that support the company’s Cyber Defense program. You will maintain security platforms and perform initial triage of cybersecurity incidents, collaborating with incident responders and technology teams to improve detection, containment, and recovery.

This role is remote with occasional travel to Southfield, Michigan.

Qualifications

• Bachelor’s degree or equivalent practical experience.
• Minimum 2 years of experience in cybersecurity engineering, security operations, incident response, or related field.
• Hands-on experience with enterprise security platforms (SIEM, EDR, secure web access, WAF, automation or detection engineering).

Responsibilities

• Operate, maintain, and improve enterprise Cyber Defense platforms across endpoints, web, network, monitoring, and automation services.
• Maintain SIEM integrations; onboard telemetry and resolve ingestion or data-quality issues.
• Perform initial triage of cybersecurity alerts; gather evidence, document findings, and escalate as needed.
• Build detection logic and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.
• Develop playbooks and use Infrastructure as Code and version control to maintain resources.
• Support containment, remediation, and recovery actions across enterprise and cloud environments.

Skills

Cybersecurity engineering

Security operations

Incident response

Scripting

APIs

Version control

IaC

Cloud security

Least-privilege access

Education

Bachelor's degree in CS/Information Systems/Cybersecurity or related field

Tools

APIs

Job description

Credit Acceptance is proud to be an award-winning company recognized both locally and nationally across multiple workplace categories. Our world-class culture is shaped by dedicated team members who are driven to succeed as professionals individually and together as a team. Backed by a strong product, exceptional people, and a stable financial foundation, we’ve grown into a leading provider of used and new car financing across the country.Our Engineering and Analytics Team Members utilize the latest technology to develop, monitor, and maintain complex practices that help optimize our success. Our Team Members value being challenged, are encouraged to express their ideas, and have the flexibility to enjoy work life balance. We build intrinsic value by partnering with all functions of our business to support their success and make strategic business decisions. We focus on professional development and continuous improvement while enjoying a casual work environment and Great Place to Work culture!As a Security Operations Engineer II, you will engineer, operate, and automate capabilities that support the company’s Cyber Defense program. You will maintain security platforms and perform initial triage of cybersecurity incidents. You will work with incident responders and technology teams to improve detection, containment, and recovery. Success in this role means reliable security services, faster response, and less manual work.Outcomes and ActivitiesInformation SecurityThis position will work from home; occasional planned travel to an assigned Southfield, Michigan office location may be required. However, this position is permitted to work at a Southfield, Michigan office location if requested by the team member.Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services.Maintain next-generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, or data-quality issues.Maintain endpoint detection and response capabilities; support investigations and approved containment actions.Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues.Support web application protections with network and application teams; help implement rules, logging, integrations, and approved exceptions.Perform initial triage of cybersecurity alerts and incidents; gather evidence, document findings, determine scope, and escalate as needed.Support approved containment, remediation, and recovery actions across enterprise and cloud environments.Develop and tune detection logic to improve signal quality and investigative value.Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.Use Infrastructure as Code, version control, testing, and change-management practices to maintain approved Cyber Defense resources.Use AI-assisted workflows to improve analysis and efficiency while applying access controls, testing, human oversight, and audit requirements.Monitor platform health; maintain technical documentation; share knowledge; and participate in security projects and the on-call rotation.OtherPerform all other duties as assigned.Participate in on-call rotations, including nights, weekends, and holidays.Remains compliant with our policies, processes and legal guidelines.Works primarily remotely with some occasional travel to a Credit Acceptance building.Competencies:Customer Empathy: Customer Empathy is the ability to understand the perspectives, pain points, and experiences of customers. It involves actively putting oneself in the customer’s shoes, comprehending their needs and challenges, and using that understanding to provide a better, more customer-centric experience.Engineering Excellence: Engineering Excellence is about bringing great craftsmanship and thought leadership to deliver an outstanding product that delights customers and solves for the business. This involves the pursuit and achievement of high standards, best practices, innovation, and superior solutions.One Team: A One Team mindset refers to a collaborative approach across the organization, where individuals work together seamlessly, without boundaries, as a single, cohesive team. Shared goals, open communication and mutual support create a sense of collective purpose. This enables teams to navigate challenges and pursue shared objectives more effectively.Owner’s Mindset: Owner’s Mindset involves adopting a set of behaviors that reflect a sense of responsibility, accountability, strategic thinking, and a proactive approach to managing your domain. As an owner, you understand the business and your domain(s) deeply and solve for the right outcome for the domain(s) and the business.Requirements:Bachelor’s degree in computer science, Information Systems, Cybersecurity, or a related field, or equivalent practical experience.Minimum 2 years of experience in cybersecurity engineering, security operations, incident response, or a related technical field.Experience triaging cybersecurity alerts or incidents and supporting approved containment actions.Hands-on experience supporting enterprise security platforms in at least two areas such as SIEM, EDR, secure web access, WAF, automation, or detection engineering.Experience using a scripting or automation language and working with APIs, webhooks, or structured configuration files.Experience with version control and Infrastructure as Code concepts.Working knowledge of cloud services and cloud security logs.Understanding of secure authentication, credential handling, and least-privilege access.Knowledge of incident response, common attacker techniques, and established cybersecurity frameworks.Ability to troubleshoot across multiple technologies and produce clear technical documentation.Preferred:Experience investigating incidents in public cloud environments and using cloud logs to determine scope.Experience with security orchestration, incident-response automation, telemetry onboarding, or detection engineering.Experience with secure web access or web application protection.Experience creating reusable Infrastructure as Code modules.Experience using AI-assisted development, agent-based workflows, or containerized automation.Relevant cybersecurity, security operations, cloud fundamentals, or automation certifications.Understanding of Credit Acceptance’s business model, operations and business terminology.Knowledge and Skills:Knowledge of cyber threats, vulnerabilities, and common attack methods.Ability to connect security telemetry with investigative needs and translate response needs into maintainable automation.Sound judgment during incident triage, containment, and escalation.Critical thinking, attention to detail, and the ability to learn unfamiliar technologies quickly.Ability to manage competing priorities and act independently.Clear written and verbal communication tailored to the audience.Ability to work across teams, share knowledge, and escalate risk appropriatelyTarget Compensation: A competitive base salary range from $84,670 – $124,184. This position is eligible for an annual variable cash bonus, between 7.5 - 15%. Bonus amounts are based on individual performance. Final compensation within the range is influenced by many factors including role-specific skills, depth and experience level, industry background, relevant education and certifications.Candidates who reside in the following major metropolitan areas may be eligible for a premium on top of the posted range based on their specific zone: San Francisco, Seattle, Boston, New York City, Los Angeles and San Diego.INDENGLP#zip#LI-RemoteBenefitsExcellent benefits package that includes 401(K) match, adoption assistance, parental leave, tuition reimbursement, comprehensive medical/ dental/vision and many nonstandard benefits that make us a Great Place to WorkOur Company Values:To be successful in this role, Team Members need to be:Positive by maintaining resiliency and focusing on solutionsRespectful by collaborating and actively listeningInsightful by cultivating innovation, accumulating business and role specific knowledge, demonstrating self-awareness and making quality decisionsDirect by effectively communicating and conveying courageEarnest by taking accountability, applying feedback and effectively planning and priority settingExpectations:Remain compliant with our policies processes and legal guidelinesAll other duties as assignedAttendance as required by departmentAdvice !We understand that your career search may look different than others. Our hiring team wants to make sure that this would be a fit not just for us, but for you long term. If you are actively looking or starting to explore new opportunities, send us your application!P.S .We have great details around our stats, success, history and more. We’re proud of our culture and are happy to share why – let’s talk!Required degrees must have been earned at institutions of Higher Education which are accredited by the Council for Higher Education Accreditation or equivalent.Credit Acceptance is dedicated to providing a safe and inclusive working environment for all. As part of our Culture of Compliance, we are proud to be an Equal Opportunity Employer and value our culturally diverse workforce. All qualified applicants will receive consideration for employment regardless of the person’s age, race, color, religion, sex, gender, sexual orientation, gender identity, national origin, veteran or disability status, criminal history, or any other legally protected characteristic.California Residents: Please click here for the California Consumer Privacy Act (CCPA) notice regarding the personal information Credit Acceptance may collect from you.