Senior Threat Detection & Incident Response Engineer

eBay; Austin (TX); On-site; USD 119,000 - 206,000; Full time

Job summary

eBay is seeking a senior incident response and detection engineer to protect its global marketplace. You will lead investigations across endpoint, cloud, and network domains, building scalable detections and response playbooks while driving automation and threat-informed defense.

This role participates in an on-call rotation and collaborates across teams. Ideal candidates bring 5+ years in security operations, strong scripting in Python, and experience with AWS, Azure, and GCP, plus Kubernetes.

Qualifications

• 5+ years in incident response, detection engineering, threat hunting, or related security field.
• Understanding of adversary TTPs and translating them into detections and mitigations.
• Hands-on experience with cloud and SaaS (AWS, Azure, and GCP) deployments.
• Experience with Kubernetes or containerized environments and cluster telemetry.
• Strong forensics fundamentals and network analysis.
• Scripting or automation in Python or similar language; good communication; on-call rotation.

Responsibilities

• Lead high-impact incident response across intrusions, insider threats, and misuse; tune SIEM detections.
• Investigate complex security events end-to-end using telemetry; drive containment and recovery.
• Apply threat modeling to systems to derive practical telemetry and detection needs.
• Hunt for attacker behavior; identify visibility gaps; build playbooks and detective controls.
• Develop automation and tooling, including AI-assisted workflows for safe, auditable responses.

Skills

Incident response

Detection engineering

Threat hunting

Cloud/SaaS experience

Kubernetes/Container telemetry

Python scripting

Communication

On-call rotation

Tools

Kubernetes

Job description

eBay is seeking a senior incident response and detection engineer to protect its global marketplace. You will lead investigations across endpoint, cloud, and network domains, building scalable detections and response playbooks while driving automation and threat-informed defense.

This role participates in an on-call rotation and collaborates across teams. Ideal candidates bring 5+ years in security operations, strong scripting in Python, and experience with AWS, Azure, and GCP, plus Kubernetes.