Senior Security Engineer- Security Operations

GE Appliances, a Haier company; Louisville (KY); On-site; USD 120,000 - 180,000; Full time

Job summary

GE Appliances, a Haier company, is seeking a Senior Security Engineer, Security Operations to own the SOC engineering across enterprise IT, cloud, and OT. This role partners with MSSP to improve detection coverage and response speed.

The candidate will lead detection content, telemetry, and automation, mentoring staff and driving measurable improvements in security operations. Location: Louisville, KY.

Qualifications

• Bachelor’s degree in information systems, cybersecurity, computer science, or equivalent.
• 6–10 years of IT or information security experience with at least 4+ years in security operations.
• Hands-on experience with SIEM/SOAR and EDR/XDR platforms; knowledge of MITRE ATT&CK is a plus.

Responsibilities

• Serve as the senior technical lead for security operations, owning architecture and health of detection and response platforms.
• Design, test, and maintain detection content — rules, analytics, IOC/BIOC; manage detection lifecycle with code practices.
• Own telemetry coverage; onboard and normalize log sources across endpoints, cloud, network, and OT; monitor health.
• Engineer SOAR playbooks and integrations to automate containment and reduce MSSP handling time.
• Oversee MSSP output; review triage quality, escalation accuracy, and run-book adherence; tune detections.
• Lead complex incidents as Tier 3 escalation point, coordinating containment and post-incident actions.

Skills

Security operations

Detection engineering

Incident response

SIEM/SOAR

EDR/XDR

MSSP coordination

Education

Bachelor’s degree in Information Systems, Cybersecurity, CS

Tools

Palo Alto Cortex XSOAR

EDR/XDR platforms

Job description

At GE Appliances, a Haier company, we come together to make “good things, for life.”As the fastest-growing appliance company in the U.S., we’re powered by creators, thinkers and makers who believe that anything is possible and that there’s always a better way.We believe in the power of our people and in giving them the freedom to explore, discover and build good things, together.

The GE Appliances philosophy, backed by three simple commitments defines the way we work, invent, create, do business, and serve our communities:we come together,we always look for a better way,andwe create possibilities.

Interested in joining us on our journey?

GE Appliances is seeking a Senior Security Engineer, Security Operations to serve as the senior technical lead for the company’s detection and response capability. Day-to-day 24x7 monitoring, alert triage, and vulnerability operations are delivered by our managed security services provider (MSSP); this role is not a shift lead or people manager. Instead, it owns the engineering behind the SOC — the detection and response platforms, detection content, automation, and telemetry — and drives the execution and continuous enhancement of how threats are detected, investigated, and contained across enterprise IT, cloud, and manufacturing (OT) environments. The engineer acts as the MSSP’s technical counterpart and the escalation point for complex incidents, and is accountable for measurable improvements in detection coverage, detection fidelity, and response speed.

Position

Senior Security Engineer- Security Operations

Location

USA, Louisville, KY

How You’ll Create Possibilities

Key Responsibilities:

• Serve as the senior technical lead and subject-matter expert for security operations, owning the architecture, configuration, and operational health of the detection and response platforms and setting the technical standards the MSSP operates against.

• Design, build, test, and maintain detection content — correlation rules, behavioral analytics, and IOC/BIOC rules — mapped to the MITRE ATT&CK framework, and manage the full detection lifecycle using detection-as-code practices (version control, testing, peer review, and documentation).

• Own telemetry coverage: identify visibility gaps and onboard, parse, and normalize log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitor ingestion health and manage data volume and retention cost.

• Engineer security automation and orchestration (SOAR) playbooks and integrations that enrich alerts, automate containment, and connect security tooling with IT service management and collaboration platforms to reduce manual effort and MSSP handling time.

• Provide technical oversight of MSSP output, in partnership with the Information Security leader who owns the MSSP commercial relationship: review triage and investigation quality, escalation accuracy, and run-book adherence; drive false-positive reduction and tuning; and update MSSP run books and playbooks as detections and the environment change.

• Serve as the Tier 3 escalation point and technical lead for complex or high‑severity incidents escalated by the MSSP, performing hands‑on investigation, endpoint and log analysis, scoping, and containment, and coordinating with the external incident response retainer when engaged.

• Lead hypothesis-driven threat hunting informed by threat intelligence and threats targeting manufacturing, converting hunt findings into durable detections and hardening recommendations.

• Operationalize threat intelligence by translating advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions, and track threat actors relevant to GE Appliances.

• Validate detection and response effectiveness through purple-team exercises, adversary emulation, and breach‑and‑attack simulation, measuring coverage against MITRE ATT&CK and confirming that the MSSP detects and responds as expected.

• Maintain EDR/XDR platform health across the endpoint and server estate, including agent coverage, prevention and exploit‑protection policies, exclusions governance, and response actions.

• Strengthen the technical side of vulnerability operations run by the MSSP, including scan coverage and authenticated scanning, risk‑based prioritization using exploitability and threat intelligence (e.g., CISA KEV, EPSS), correlation of vulnerabilities with active threat activity, and automation of remediation workflows.

• Partner with the Cloud, Network, and Identity security engineers to integrate cloud security posture (CNAPP), network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and adversary‑in‑the‑middle (AiTM) phishing.

• Partner with OT Security to extend monitoring and detection into manufacturing environments in a way that is safe for production and consistent with ISA/IEC 62443 and NIST SP 800‑82.

• Author and maintain incident response playbooks, technical run books, and tabletop exercise scenarios, and lead the technical portion of post‑incident reviews to drive corrective actions to closure.

• Define, automate, and report operational metrics and KPIs, such as MTTD, MTTR, ATT&CK detection coverage, false‑positive rate, log source health, and MSSP escalation quality, to the CISO and Information Security leadership.

• Contribute to the security operations roadmap; evaluate emerging capabilities, including AI‑assisted triage and investigation and agentic SOC automation; and support platform evaluations, proofs of concept, and total cost of ownership (TCO) analyses.

• Provide technical evidence for logging, monitoring, and incident response controls in SOX, C‑SOX, PCI‑DSS, and other audits, and drive remediation of related findings.

• Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.

What You’ll Bring to Our Team

Requirements & Qualifications:

• Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience.

• 6–10 years of progressive experience in IT or information security, with at least 4+ years of hands‑on experience in security operations, detection engineering, or incident response in a large enterprise environment.

• Deep hands‑on experience engineering and administering SIEM/SOAR and EDR/XDR platforms (e.g., Palo Alto Networks Cortex X