Security Operations Engineer

Segment: Global Cybersecurity Operations

Reports To: Global Cybersecurity Operations Manager

The Security Operations Engineer is responsible for engineering, operating, and continuously improving the organization's security operations capabilities, with a primary focus on incident response, detection engineering, security automation, email security, and AI-enabled security operations.

This role serves as a technical escalation point for complex cybersecurity incidents while identifying and engineering opportunities to make security operations more effective, automated, scalable, and resilient.

The Security Operations Engineer is expected to bring a strong engineering and innovation mindset: challenging existing processes, identifying inefficiencies, thinking beyond established approaches, evaluating emerging technologies, and turning successful ideas into sustainable security capabilities.

The role works closely with the AI & Data Security Engineer and Azure Security Engineer to safely introduce and operationalize AI-enabled security capabilities.

Incident Response & Investigation

• Serve as a primary technical escalation point for complex cybersecurity incidents.
• Investigate security incidents across identity, endpoint, email, cloud, network, and SaaS environments.
• Lead technical investigation, containment, eradication, and recovery activities.
• Perform root-cause analysis and identify opportunities to prevent recurrence.
• Conduct compromise assessments and technical threat investigations.
• Improve incident-response playbooks, procedures, and investigative workflows.
• Translate lessons learned from incidents into improved detections, controls, and processes.

Detection Engineering & Optimization

• Design, develop, tune, and continuously improve security detections and alerts.
• Identify false positives, false negatives, detection gaps, and opportunities to improve coverage.
• Develop detection logic based on threat intelligence, incident findings, attacker behavior, and emerging techniques.
• Develop advanced security queries and investigative methods.
• Translate investigations and threat intelligence into new or improved detections.
• Engineer improvements that increase detection fidelity while reducing unnecessary operational workload.
• Identify opportunities to automate detection development, enrichment, investigation, and response.

AI-Enabled Security Operations

• Engineer and continuously improve AI-enabled security operations capabilities.
• Identify opportunities to use AI agents for investigation, threat intelligence, detection engineering, alert triage, and incident response.
• Work closely with the AI & Data Security Engineer to evaluate, implement, validate, and operationalize AI-enabled security capabilities.
• Configure and optimize AI-assisted security workflows and agents for operational use.
• Validate AI-generated findings, recommendations, detections, and response actions before production use.
• Evaluate the accuracy, effectiveness, limitations, and operational value of AI-generated security outputs.
• Establish appropriate human-review and escalation requirements for AI-assisted security operations.
• Convert successful AI proofs of concept into reliable, documented, and maintainable operational capabilities.

Security Automation & Innovation

• Identify manual, repetitive, inefficient, or error-prone security processes and engineer opportunities for improvement.
• Develop automation, integrations, scripts, and workflows that improve investigation, response, detection, and operational efficiency.
• Continuously evaluate emerging cybersecurity technologies and their applicability to the organization.
• Participate in technical proofs of concept and objectively evaluate their results.
• Challenge existing processes and assumptions when a more effective approach is possible.
• Design solutions with scalability, maintainability, reliability, and security in mind.
• Continuously look for opportunities to move security operations from reactive processes toward proactive, engineered capabilities.

Managed Security Service Provider Oversight

• Serve as the technical security operations counterpart to managed security service providers.
• Review and validate escalated incidents and investigations.
• Evaluate alert quality, investigation effectiveness, and operational performance.
• Identify recurring false positives, missed detections, and process gaps.
• Work with service providers to tune detections, improve escalation criteria, and optimize operational processes.
• Challenge and validate recommendations where appropriate.
• Identify opportunities to improve capabilities through engineering, automation, or internal ownership.

Email & Identity Security Operations

• Own the technical security operations of the organization's email-security capabilities.
• Investigate phishing, malicious email, impersonation, business email compromise, malicious attachments, malicious URLs, and compromised accounts.
• Develop and tune email-security detections and policies.
• Support phishing investigations, simulations, and security-awareness initiatives.
• Investigate suspicious authentication, account compromise, privilege abuse, and anomalous identity activity.
• Support improvements to authentication and access-control policies based on operational findings.
• Partner with cybersecurity and architecture teams on identity-security improvements.

Security Operations Collaboration

• Partner with the AI & Data Security Engineer on AI-enabled security operations and emerging technologies.
• Collaborate with the Azure Security Engineer on cloud and identity investigations.
• Engage the Azure Security Architect when operational findings identify architectural requirements or systemic security gaps.
• Collaborate with the Connectivity Security Engineer on network-related investigations and security improvements.
• Cross-train with other Cybersecurity Operations specialists and contribute to shared operational knowledge.

Required Qualifications

• Strong hands-on experience in incident response and security investigations.
• Experience investigating identity, endpoint, email, cloud, network, and SaaS security events.
• Experience developing, tuning, or engineering security detections and alerts.
• Experience with SIEM, XDR, EDR, email-security, or security-monitoring technologies.
• Experience with threat intelligence, investigation, and IOC analysis.
• Strong understanding of attacker behavior and common attack techniques.
• Experience developing security automation, scripts, integrations, or workflows.
• Strong analytical, critical-thinking, troubleshooting, and problem-solving skills.
• Demonstrated ability to identify opportunities for improvement rather than simply following established processes.

Preferred Qualifications

• Microsoft Security Operations certification or equivalent experience.
• Experience with SIEM, XDR, EDR, SOAR, or security orchestration technologies.
• Experience with AI-assisted security operations or AI agents.
• Experience evaluating or validating AI-generated security analysis.
• Digital forensics or malware-analysis experience.
• Threat intelligence experience.
• Security automation and scripting experience.
• Experience with email authentication and security technologies.
• Experience designing or participating in security proofs of concept.
• Experience working with an MSSP or external security provider.