Senior Detection Engineering & Automation Manager

KPMG LLP; San Diego (CA); On-site; USD 140,000 - 190,000; Full time

Job summary

KPMG LLP in San Diego, California, seeks a Manager, Content Development, Detection Engineering & Automation to strengthen our Enterprise Security Services program. You will design, validate, and tune detection content, lead automation efforts, and work across Threat Intelligence, SOC, and Incident Response to strengthen defenses.

Responsibilities include building detection rules in KQL for Microsoft Sentinel, orchestrating playbooks in Cortex XSOAR, and integrating OpenTelemetry pipelines to

Qualifications

• 5+ years in security monitoring and incident response.
• Bachelor's degree preferred; high school diploma required; related certifications preferred.
• Experience integrating SIEM/EDR/SOAR with core IT infrastructure.

Responsibilities

• Execute end-to-end engineering lifecycle for security detection content.
• Collaborate with Threat Intelligence, SOC, and IR teams mapping detections to MITRE ATT&CK.
• Design and optimize detection rules and alerts using KQL in Microsoft Sentinel.
• Build and maintain automated incident response playbooks and Cortex XSOAR integrations.
• Automate repetitive tasks and threat intel enrichment to reduce MTTR.
• Uphold professional integrity and respectful work environment.

Skills

Security monitoring

Security operations

Incident response

Azure Sentinel

XDR

CrowdStrike

XSOAR

Splunk

ServiceNow

OpenTelemetry

Scripting

API usage

MITRE ATT&CK

Education

Bachelor's degree

CISSP

CISM

CEH

GIAC

XSOAR Engineer

Tools

Azure Sentinel

XSOAR

CrowdStrike

Splunk

ServiceNow

Job description

KPMG LLP in San Diego, California, seeks a Manager, Content Development, Detection Engineering & Automation to strengthen our Enterprise Security Services program. You will design, validate, and tune detection content, lead automation efforts, and work across Threat Intelligence, SOC, and Incident Response to strengthen defenses.

Responsibilities include building detection rules in KQL for Microsoft Sentinel, orchestrating playbooks in Cortex XSOAR, and integrating OpenTelemetry pipelines to