Senior Cyber Security Specialist II - Threat Detection and Response

Walgreens; Chicago (IL); Hybride; USD 120 000 - 190 000; Plein temps

Résumé du poste

Walgreens is seeking a Senior Cyber Security Specialist II - Threat Detection and Response to lead complex security investigations, enhance enterprise detection capabilities, and improve incident response across hybrid environments.

You will own investigations end to end, mentor team members, and develop automation to speed detection and response. The role spans on-premises and cloud, requiring strong technical judgment and cross-team collaboration.

Responsabilités

• Designing, implementing, and tuning detection logic across enterprise and cloud environments
• Leading complex incident response efforts and driving investigations through resolution
• Conducting proactive threat hunting and converting findings into actionable detections
• Developing automation to improve detection, enrichment, triage, and response workflows
• Partnering with security, engineering, infrastructure, and business teams to improve logging, telemetry, and observability
• Identifying gaps in detection coverage, tooling, processes, and response procedures
• Providing technical guidance, mentoring team members, and contributing to team capability through knowledge sharing, documentation, and tabletop exercises
• Communicating technical findings clearly to leadership and technical audiences

Description du poste

Senior Cyber Security Specialist II - Threat Detection and Response

Job Summary

This role supports Walgreens’ Threat Detection and Response function, with a focus on leading complex security investigations, advancing enterprise detection capabilities, and improving incident response effectiveness across hybrid environments. As a senior-level individual contributor, you will serve as a technical escalation point for high-impact and complex security incidents, owning investigations end to end from triage through root cause analysis, containment, remediation, and post-incident improvement. This role requires deep hands‑on expertise, strong judgment, and the ability to operate independently in ambiguous and time-sensitive situations. You will help shape detection strategy by building and tuning detection logic, proactively hunting for threats, and using automation to improve response speed, consistency, and scalability. This work spans hybrid infrastructure, cloud environments, applications, identity systems, endpoints, and enterprise platforms, using log analysis, behavioral signals, threat intelligence, and attacker TTPs to identify and mitigate risk.

Key responsibilities include:

• Designing, implementing, and tuning detection logic across enterprise and cloud environments
• Leading complex incident response efforts and driving investigations through resolution
• Conducting proactive threat hunting and converting findings into actionable detections
• Developing automation to improve detection, enrichment, triage, and response workflows
• Partnering with security, engineering, infrastructure, and business teams to improve logging, telemetry, and observability
• Identifying gaps in detection coverage, tooling, processes, and response procedures, and driving improvements
• Providing technical guidance, mentoring team members, and contributing to overall team capability through knowledge sharing, documentation, and tabletop exercises
• Communicating technical findings clearly to both technical and non-technical audiences, including leadership when needed

Location Requirement:

This is a hybrid role based in Deerfield, IL, with 4 days onsite and 1 day remote.

Work Authorization:

Work visa sponsorship is not available for this role.

Job Responsibilities

• Leads threat detection by identifying threats at the first phase of an attack or compromise. Detects threat actor activity including exploitation and risk to critical systems.
• Monitors specific cyber threat actors to understand their tactics and techniques.
• Utilizes data analysis, threat intelligence and cutting‑edge security technologies to find unusual behavior and malicious activity.
• Leads the hunt for hidden and unidentified threats to the organization’s cyber environment.
• Tracks down the malicious agents who are already in a network and removes them from the environment once discovered. etc