Security Operations Engineer II

creditacceptance; United States; Remote; USD 120,000 - 160,000; Full time

Benefits offered by this job

Remote work

Travel to Michigan

Job summary

Credit Acceptance seeks a cybersecurity engineer to operate and improve security platforms that support the organization’s cyber defense program. The role blends platform maintenance and automation with first-response incident triage, collaborating with responders and technology teams to strengthen detection, containment, and recovery while reducing manual effort.

Primarily remote with occasional travel to an assigned office in Southfield, Michigan; benefits include medical, dental, and vision

Qualifications

• Bachelor’s degree or equivalent practical experience in a relevant field.
• At least two years in cybersecurity engineering, security operations, incident response, or related technical work.
• Experience triaging security alerts or incidents and supporting containment actions.
• Hands-on experience with at least two enterprise security areas (SIEM, EDR, secure web access, WAF, automation, or detection engineering).
• Scripting/automation experience, APIs or webhooks, and version control or IaC concepts.
• Working knowledge of cloud services, security logs, secure authentication, and least-privilege access.
• Understanding of incident response, attacker methods, and cybersecurity frameworks.

Responsibilities

• Maintain and improve enterprise security capabilities across endpoint, web, network, monitoring, and automation services.
• Support SIEM integrations by onboarding telemetry and troubleshooting ingestion, parsing, and data-quality problems; maintain EDR tools.
• Triages alerts and incidents, gathers and documents evidence, assesses scope, and escalates when needed; assist with containment, remediation, and recovery.
• Tune detection logic and support web app protections, secure web access policies, and approved exceptions.
• Create response playbooks and automate repeatable investigation tasks using scripts, APIs, or webhooks; maintain resources with IaC and change-management practices.
• Monitor platform health, keep documentation current, contribute to security projects, and participate in on-call rotations.

Skills

Cybersecurity engineering

Security operations

Incident response

Automation scripting

Cloud security

Technical writing

Education

Bachelor's degree

Tools

SIEM

EDR

Web application firewall

Job description

Role overview

Operate and improve the security platforms that support an organization’s cyber defense program. This engineering role combines platform maintenance and automation with first-response incident triage, working with responders and technology teams to strengthen detection, containment, and recovery while reducing manual effort.

Responsibilities

• Maintain and improve enterprise security capabilities across endpoint, web, network, monitoring, and automation services.
• Support SIEM integrations by onboarding telemetry and troubleshooting ingestion, parsing, and data-quality problems; maintain endpoint detection and response tools.
• Triage alerts and incidents, gather and document evidence, assess scope, and **escalate** when needed; assist with approved containment, remediation, and recovery.
• Tune detection logic and support web application protections, secure web access policies, and approved exceptions.
• Create response playbooks and automate repeatable investigation tasks using scripts, APIs, or webhooks; maintain approved resources with infrastructure-as-code and change-management practices.
• Monitor platform health, keep documentation current, contribute to security projects, and take part in an on-call rotation that may include nights, weekends, and holidays.

Requirements

• A bachelor’s degree in a relevant field or equivalent practical experience, plus at least two years in cybersecurity engineering, security operations, incident response, or related technical work.
• Experience triaging security alerts or incidents and supporting authorized containment actions.
• Hands‑on experience with at least two enterprise security areas, such as SIEM, endpoint detection and response, secure web access, web application firewalls, automation, or detection engineering.
• Experience with a scripting or automation language, APIs or webhooks, and version control or infrastructure-as-code concepts.
  
• Working knowledge of cloud services and security logs, secure authentication, credential handling, and least-privilege access.
• Understanding of incident response, common attacker methods, and cybersecurity frameworks; ability to troubleshoot across technologies and write clear technical documentation.

Nice to have

Experience investigating incidents in public cloud environments, onboarding telemetry, developing detections, or automating security response. The role may use AI-assisted workflows, with access controls, testing, human oversight, and audit requirements.

Benefits and work setup

Primarily remote, with occasional planned travel to an assigned office in Southfield, Michigan; office work may also be requested.

The source lists medical, dental, and vision coverage, retirement-plan matching, parental and adoption assistance, tuition reimbursement, and other benefits.