Sr Detection and Response Engineer, Information Security

CommScope; Charlotte (NC); On-site; USD 120,000 - 170,000; Full time

Job summary

CommScope is seeking a Senior Detection and Response Engineer to lead complex investigations end‑to‑end in a global SOC. You will own detections, automations, and AI‑assisted workflows, reduce manual effort, and shorten detection and response times.

You will mentor analysts, coordinate with MDR partners, and contribute to incident reports and metrics across IT and OT environments. This hands‑on technical role requires strong SIEM/EDR expertise, scripting, and a track record in security

Qualifications

• Bachelor’s degree in a related field or equivalent experience.
• 6+ years in information security with SOC/IR experience.
• Proven ability to lead investigations and response for major incidents.
• Strong SIEM/EDR proficiency and scripting in Python/PowerShell.

Responsibilities

• Serve as L3 escalation point for alerts and incidents; lead containment, eradication, and recovery.
• Act as technical incident lead for high-severity events with stakeholder coordination.
• Design, build, test, and tune detections using SIEM/EDR with MITRE ATT&CK mapping.
• Build and maintain SOAR playbooks and automations; integrate tooling via APIs.

Skills

SOC leadership

Incident response

KQL / SIEM tuning

Python / PowerShell

AI in security

MITRE ATT&CK

Education

Bachelor’s in Information Security or related

Tools

Microsoft Sentinel

CrowdStrike NG-SIEM

Cribl

SOAR tooling

Job description

Select how often (in days) to receive an alert:

Sr Detection and Response Engineer, Information Security

Location: Charlotte, North Carolina, United States

In our ‘always on’ world, we believe it’s essential to have a genuine connection with the work you do.

Sr Detection and Response Engineer, Information Security

Job Number: 82746

Reports To: Manager, Security Operations

FLSA Status: Exempt

PLEASE NOTE : This is an onsite position located in the Charlotte, NC metro area. Team members are expected to work from the officefive days per week to support collaboration, innovation, and business objectives.

General Summary

CommScope is seeking a Senior Detection and Response Engineer to serve as a L3 technical lead and escalation point in our Security Operations Center. This is a hands‑on engineering role. You will own complex investigations and incident response end to end, and build the detections, automations, and AI‑assisted workflows that let a lean team operate at scale.

You will work closely with our MDR partner and junior analysts, turning lessons learned from incidents into durable detection and response capability across a global IT and manufacturing (OT) environment. You will be expected to reduce manual effort, improve signal quality, and measurably shorten time to detect and respond.

CommScope’s security team protects the people, processes, and technologies that serve our customers, and their customers: the billions of people our products and services help connect every day.

Duties & Responsibilities

Incident Response and Escalation

• Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and our MDR provider. Lead investigations through containment, eradication, and recovery.
• Act as technical incident lead for high‑severity events. Coordinate with IT, infrastructure, OT, and business stakeholders, and produce clear executive and technical incident reports.
• Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.

Detection Engineering

• Design, build, test, and tune detections in the SIEM and EDR (Microsoft Sentinel, CrowdStrike NG‑SIEM) using KQL and related query languages. Map coverage to MITRE ATT&CK and CommScope’s top enterprise and OT threat scenarios.
• Own the detection lifecycle, including false‑positive reduction, coverage gap analysis, and detection‑as‑code practices with version control and peer review.
• Engineer log pipelines and data quality with Cribl, so the telemetry needed for detection and investigation is complete, normalized, and cost‑effective.

Automation and AI

• Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure. Target measurable reductions in analyst hours and MTTR.
• Design, test, and operationalize AI‑assisted SOC workflows, such as Copilot agents, LLM‑based triage and summarization, and guided playbook agents. Apply appropriate guardrails: least privilege, human approval for destructive actions, prompt‑injection resilience, and output validation.
• Integrate security tooling through APIs and scripting (Python, PowerShell) to remove manual, repetitive work.

Threat Hunting and Intelligence

• Conduct hypothesis‑driven threat hunts informed by current threat intelligence and actor TTPs, and convert findings into new detections.
• Assess emerging vulnerabilities and threats for CommScope exposure, and recommend prioritized response actions.

Program and Team

• Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises.
• Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer.
• Report on SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved.
• Participate in the on‑call rotation (PagerDuty) as the senior escalation tier.

Accountability / Impact

Global CommScope footprint

Manages Complexity : Makes sense of complex, high‑volume, and sometimes contradictory security data to find root causes and resolve incidents.

Decision Quality: Makes sound, timely containment and response decisions based on analysis, experience, and judgment, and serves as a trusted source of technical advice.

Optimizes Work Processes : Continuously improves SOC workflows, automating manual and repetitive tasks to increase speed, consistency, and efficiency.

Tech Savvy: Anticipates the impact of emerging technologies, including AI, and adopts tools that deliver real value.

Action Oriented: Acts with urgency and decisiveness in fast‑changing, unpredictable situations, and steps up to manage tough issues.

Being Resilient: Stays composed and effective under pressure, rebounding from setbacks while keeping incident response on track.

Communicates Effectively: Delivers clear, timely communication tailored to the audience, from technical incident details to executive summaries.

Required Qualifications for Consideration

• Bachelor’s in related curriculum such as
• Information Security, Computer Science, or related field (or equivalent experience )
• 6+ Years of Related Experience

Skills Required

Include demonstrated competencies and physical, mental, & interpersonal skills.

• 6+ years in information security, including 3+ years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent. Bachelor’s degree in a related field or equivalent professional experience.
• Proven experience leading investigations and response for significant security incidents in an enterprise environment.
• Advanced proficiency with SIEM and EDR platforms (Microsoft Sentinel and CrowdStrike NG‑SIEM preferred), including authoring and tuning detections in KQL or similar.
• Hands‑on experience building SOAR playbooks and automations. Scripting proficiency in Python and/or PowerShell, plus REST API integration.
• Practical experience applying AI or LLM tools to security operations (triage, enrichment, summarization, query generation), with a clear understanding of their risks and limits.
• Strong working knowledge of Windows, Linux, and macOS internals, Active Directory and Entra ID, email security, network protocols, and cloud (Azure/M365) attack surfaces.
• Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.
• Clear written and verbal communication, including incident reports for both technical and executive audiences.
• Self-directed, with sound judgment under pressure and the ability to prioritize across competing incidents and engineering work.
• DESIRED – Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.
• DESIRED – Experience with OT/ICS security monitoring in manufacturing environments.
• DESIRED – Experience with log pipeline tooling (Cribl), detection‑as‑code, and Git‑based workflows.
• DESIRED – Experience working with an MDR provider.
• A live investigation exercise using a sample alert or log set, ending with a short written summary.
• A detection or automation design walkthrough. For example: write a KQL detection and describe how you would automate the response, including AI use and guardrails.

Why CommScope:

CommScope is on a quest to deliver connectivity that empowers how we live, work, and learn. Our employees push the boundaries of communications technology that enables game‑changing discoveries like 5G, the Internet of Things, and gigabit speeds for everyone, everywhere. With our unmatched expertise in copper, fiber, and wireless infrastructure, our global clients rely on us to outperform today and be ready for the needs of tomorrow.

If you want to grow your career alongside bright, passionate, and caring people who strive to create what's next…come connect to your future at CommScope.

CommScope is an Equal Opportunity Employer (EEO), including people with disabilities and veterans. If you are seeking an accommodation for the application or interview process, please contact us to submit your request at [e-mail]. You can also learn more about CommScope’s accommodation process and EEO policy at https://jobs.commscope.com/eeo