Security Operations Engineer II

Role overview Operate and improve the security platforms that support an organization’s cyber defense program. This engineering role combines platform maintenance and automation with first-response incident triage, working with responders and technology teams to strengthen detection, containment, and recovery while reducing manual effort.

Responsibilities - Maintain and improve enterprise security capabilities across endpoint, web, network, monitoring, and automation services. - Support SIEM integrations by onboarding telemetry and troubleshooting ingestion, parsing, and data-quality problems; maintain endpoint detection and response tools. - Triage alerts and incidents, gather and document evidence, assess scope, and escalate when needed; assist with approved containment, remediation, and recovery. - Tune detection logic and support web application protections, secure web access policies, and approved exceptions. - Create response playbooks and automate repeatable investigation tasks using scripts, APIs, or webhooks; maintain approved resources with infrastructure-as-code and change-management practices. - Monitor platform health, keep documentation current, contribute to security projects, and take part in an on-call rotation that may include nights, weekends, and holidays.

Requirements - A bachelor’s degree in a relevant field or equivalent practical experience, plus at least two years in cybersecurity engineering, security operations, incident response, or related technical work. - Experience triaging security alerts or incidents and supporting authorized containment actions. - Hands-on experience with at least two enterprise security areas, such as SIEM, endpoint detection and response, secure web access, web application firewalls, automation, or detection engineering. - Experience with a scripting or automation language, APIs or webhooks, and version control or infrastructure-as-code concepts. - Working knowledge of cloud services and security logs, secure authentication, credential handling, and least-privilege access. - Understanding of incident response, common attacker methods, and cybersecurity frameworks; ability to troubleshoot across technologies and write clear technical documentation.

Nice to have Experience investigating incidents in public cloud environments, onboarding telemetry, developing detections, or automating security response. The role may use AI-assisted workflows, with access controls, testing, human oversight, and audit requirements.

Benefits and work setup Primarily remote, with occasional planned travel to an assigned office in Southfield, Michigan; office work may also be requested. The source lists medical, dental, and vision coverage, retirement-plan matching, parental and adoption assistance, tuition reimbursement, and other benefits.