Security Operations Engineer II – Remote & Automation

Credit Acceptance Corporation; United States; Remote; USD 85,000 - 124,000; Full time

Benefits offered by this job

401K match

Parental leave

Tuition reimbursement

Medical/Dental/Vision

Work from home options

Job summary

Credit Acceptance Corporation is seeking a Security Operations Engineer II to engineer, operate, and automate capabilities for the Cyber Defense program. You will triage incidents, maintain security platforms, and collaborate with incident responders and technology teams to improve detection, containment, and recovery.

The role emphasizes automation via scripting, APIs, and IaC, with on‑call rotations and remote work.

Qualifications

• Bachelor’s degree in computer science, Information Systems, Cybersecurity, or a related field, or equivalent practical experience.
• Minimum 2 years of experience in cybersecurity engineering, security operations, incident response, or a related technical field.
• Experience triaging cybersecurity alerts or incidents and supporting approved containment actions.
• Hands-on experience supporting enterprise security platforms in at least two areas such as SIEM, EDR, secure web access, WAF, automation, or detection engineering.
• Experience using a scripting or automation language and working with APIs, webhooks, or structured configuration files.
• Experience with version control and Infrastructure as Code concepts.
• Working knowledge of cloud services and cloud security logs.
• Understanding of secure authentication, credential handling, and least-privilege access.
• Knowledge of incident response, common attacker techniques, and established cybersecurity frameworks.
• Ability to troubleshoot across multiple technologies and produce clear technical documentation.
• Preferred: Experience investigating incidents in public cloud environments and using cloud logs to determine scope.
• Preferred: Experience with security orchestration, incident-response automation, telemetry onboarding, or detection engineering.
• Preferred: Experience with secure web access or web application protection.
• Preferred: Experience creating reusable Infrastructure as Code modules.
• Preferred: Experience using AI-assisted development, agent-based workflows, or containerized automation.
• Preferred: Relevant cybersecurity, security operations, cloud fundamentals, or automation certifications.
• Preferred: Understanding of Credit Acceptance’s business model, operations and business terminology.
• Required degrees must have been earned at institutions of Higher Education which are accredited by the Council for Higher Education Accreditation or equivalent.

Responsibilities

• Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services.
• Maintain next‑generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, or data‑quality issues.
• Maintain endpoint detection and response capabilities; support investigations and approved containment actions.
• Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues.
• Support web application protections with network and application teams; help implement rules, logging, integrations, and approved exceptions.
• Perform initial triage of cybersecurity alerts and incidents; gather evidence, document findings, determine scope, and elevate as needed.
• Support approved containment, remediation, and recovery actions across enterprise and cloud environments.
• Develop and tune detection logic to improve signal quality and investigative value.
• Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.
• Use Infrastructure as Code, version control, testing, and change‑management practices to maintain approved Cyber Defense resources.
• Use AI‑assisted workflows to improve analysis and efficiency while applying access controls, testing, human oversight, and audit requirements.
• Monitor platform health; maintain technical documentation; share knowledge; and participate in security projects and the on‑call rotation.
• Other Perform all other duties as assigned.
• Participate in on‑call rotations, including nights, weekends, and holidays.
• Remains compliant with our policies, processes and legal guidelines.
• Works primarily remotely with some occasional travel to a Credit Acceptance building.

Skills

Cybersecurity engineering

Security operations

Incident response

Scripting & automation

APIs & webhooks

Cloud basics

Education

Bachelor's degree in Computer Science or related field

Tools

SIEM

EDR

WAF

Automation

Infrastructure as Code

Job description

Credit Acceptance Corporation is seeking a Security Operations Engineer II to engineer, operate, and automate capabilities for the Cyber Defense program. You will triage incidents, maintain security platforms, and collaborate with incident responders and technology teams to improve detection, containment, and recovery.

The role emphasizes automation via scripting, APIs, and IaC, with on‑call rotations and remote work.