Senior Cyber Security Specialist II - Threat Detection and Response

Walgreens; Deerfield (IL); Hybrid; USD 127,500 - 204,000; Full time

Job summary

Walgreens is seeking a senior security professional to lead complex investigations and advance enterprise detection capabilities across hybrid environments. You will own end-to-end investigations, from triage through remediation, with hands-on scope and independent judgment.

You will shape detection strategy, hunt threats, and build automation to speed responses. Collaboration with security, engineering, and business teams is essential to strengthen defenses.

Qualifications

• Bachelor's degree or equivalent professional experience in information/cyber security.
• 5+ years of information/cyber security experience or 7+ with HS diploma.
• Experience presenting to executive leadership.

Responsibilities

• Design and tune detection logic across enterprise and cloud environments.
• Lead complex incident response efforts from triage to remediation.
• Conduct proactive threat hunting and convert findings into detections.
• Develop automation to improve detection and response workflows.
• Collaborate with security, engineering, and business teams to improve logging, telemetry, and observability.
• Mentor team members and share knowledge through docs and exercises.
• Communicate findings clearly to technical and non-technical audiences.
• Own investigations end to end, including post-incident improvements.

Skills

Threat hunting

Incident response

Data analysis

Leadership

Executive communication

Education

Bachelor’s degree

High School Diploma

Job description

Job Summary

This role supports Walgreens’ Threat Detection and Response function, with a focus on leading complex security investigations, advancing enterprise detection capabilities, and improving incident response effectiveness across hybrid environments.

Job Summary

This role supports Walgreens’ Threat Detection and Response function, with a focus on leading complex security investigations, advancing enterprise detection capabilities, and improving incident response effectiveness across hybrid environments.

As a senior-level individual contributor, you will serve as a technical escalation point for high-impact and complex security incidents, owning investigations end to end from triage through root cause analysis, containment, remediation, and post-incident improvement. This role requires deep hands‑on expertise, strong judgment, and the ability to operate independently in ambiguous and time-sensitive situations.

You will help shape detection strategy by building and tuning detection logic, proactively hunting for threats, and using automation to improve response speed, consistency, and scalability. This work spans hybrid infrastructure, cloud environments, applications, identity systems, endpoints, and enterprise platforms, using log analysis, behavioral signals, threat intelligence, and attacker TTPs to identify and mitigate risk.

Key Responsibilities Include

• Designing, implementing, and tuning detection logic across enterprise and cloud environments
• Leading complex incident response efforts and driving investigations through resolution
• Conducting proactive threat hunting and converting findings into actionable detections
• Developing automation to improve detection, enrichment, triage, and response workflows
• Partnering with security, engineering, infrastructure, and business teams to improve logging, telemetry, and observability
• Identifying gaps in detection coverage, tooling, processes, and response procedures, and driving improvements
• Providing technical guidance, mentoring team members, and contributing to overall team capability through knowledge sharing, documentation, and tabletop exercises
• Communicating technical findings clearly to both technical and non-technical audiences, including leadership when needed

Success in this role requires the ability to take ownership, make sound decisions under pressure, and independently drive outcomes across complex security scenarios. The ideal candidate is hands‑on, technically strong, comfortable navigating ambiguity, and able to influence improvements that strengthen Walgreens’ overall security posture.

Location Requirement

This is a hybrid role based in Deerfield, IL, with 4 days onsite and 1 day remote.

Work Authorization

Work visa sponsorship is not available for this role.

Job Responsibilities

• Leads threat detection by identifying threats at the first phase of an attack or compromise. Detects threat actor activity including exploitation and risk to critical systems.
• Monitors specific cyber threat actors to understand their tactics and techniques.
• Utilizes data analysis, threat intelligence and cutting-edge security technologies to find unusual behavior and malicious activity.
• Leads the hunt for hidden and unidentified threats to the organization’s cyber environment.
• Tracks down the malicious agents who are already in a network and removes them from the environment once discovered.
• Works with security monitoring tools such as firewalls, data loss prevention, network intrusion detection and antivirus software.
• Uses a hypothesis‑driven approach and behavioral analysis to uncover connections and correlations between potential cyber threats.
• Reviews audit logs to identify unusual behavior in the network and endpoint devices. Documents findings and incident investigations. Provides feedback and training to improve security controls.
• Leads in assessing network vulnerabilities and identifying critical security flaws by testing and validating the security of the network and/or testing the network to understand where vulnerabilities exist and where corrections are needed

About Walgreens

Founded in 1901, Walgreens (www.walgreens.com) has a storied heritage of caring for communities for generations and proudly serves nearly 9 million customers and patients each day across its approximately 8,500 stores throughout the U.S. and Puerto Rico, and leading omni‑channel platforms. Walgreens has approximately 220,000 team members, including nearly 90,000 healthcare service providers, and is committed to being the first choice for retail pharmacy and health services, building trusted relationships that create healthier futures for customers, patients, team members and communities.

Basic Qualifications

• Bachelor’s degree and at least 5 years of Information/Cyber Security experience OR a High School Diploma/GED and at least 7 years of Information/Cyber Security experience
• Experience presenting to and interacting with the Executive level.
• At least 4 years of Cyber Security experience in at least three of the following: Active threat hunting (open source or commercial tooling), Intrusion analysis, Managed or enterprise information security services, Incident response, Endpoint forensics (Windows, MAC, or Linux), Malware analysis, Penetration testing, Network defense, Threat hunting, Information security consulting
• Experience establishing & maintaining relationships with individuals at all levels of the organization, in the business community & with vendors.
• Experience analyzing and reporting data in order to identify issues, trends, or exceptions to drive improvement of results and find solutions.
• At least 2 years of experience contributing to financial decisions in the workplace.
• At least 2 years of direct leadership, indirect leadership and/or cross‑functional team leadership.
• Willing to travel up to/at least 10% of the time for business purposes (within state and out of state).

Preferred Qualifications

• Bachelor’s degree and at least 5 years of Information/Cyber Security experience OR a High School Diploma/GED and at least 7 years of Information/Cyber Security experience
• Experience presenting to and interacting with the Executive level.
• At least 4 years of Cyber Security experience in at least three of the following: Active threat hunting (open source or commercial tooling), Intrusion analysis, Managed or enterprise information security services, Incident response, Endpoint forensics (Windows, MAC, or Linux), Malware analysis, Penetration testing, Network defense, Threat hunting, Information security consulting
• Experience establishing & maintaining relationships with individuals at all levels of the organization, in the business community & with vendors.
• Experience analyzing and reporting data in order to identify issues, trends, or exceptions to drive improvement of results and find solutions.

We will consider employment of qualified applicants with arrest and conviction records.

Salary Range: $127500 - $204000 / Salaried