Cybersecurity Detection Engineer II

Cox Communications•Atlanta, GA

8h•Hybrid

About The Position

Cox Automotive is seeking a Cybersecurity Engineer II to join its Detection Engineering team and support cyber defense across its automotive businesses. Reporting to the Director of Cyber Detection Engineering, this individual will build, tune, and maintain enterprise- and customer-focused detection capabilities, including AI-assisted workflows and automation, with guidance from senior engineers. The role works closely with Incident Response, Threat Intelligence, Vulnerability Management, and other Cybersecurity, Engineering, and Product teams. The engineer develops and tests detections, alerts, and remediation playbooks using SIEM, EDR, and SOAR platforms; applies frameworks such as MITRE ATT&CK and ATLAS; tests detection efficacy through attack simulation; supports purple teaming and SIEM/Data Lake log ingestion; and monitors and reports detection performance. The role also contributes to incident response, threat-intelligence integration, customer-focused detection solutions, and documentation that supports regulatory requirements and industry standards. Daily use of AI tools and large language models is expected, with output validated for accuracy. The position is hybrid, has a day shift, requires no travel, and participates in an off-hours support rotation. Compensation includes a base salary range of $89,400 to $134,000, with potential eligibility for an incentive program. Employment is contingent on clearing a pre-employment drug test. Applicants must be authorized to work in the United States without current or future sponsorship.

Requirements

Bachelor’s degree in a related discipline and 2 years of experience in a related field; alternatively, a master’s degree and up to 2 years of experience, or 14 years of experience in a related field.
At least 1 year of experience in Detection Engineering or a Security Operations Center (SOC) role. Direct Detection Engineering experience is not required for candidates with SOC experience.
Working knowledge of detection concepts, including searching and writing logic with a SIEM query language such as SPL or KQL.
Hands-on experience with a SIEM, including searching and analyzing log data.
Working knowledge of information security, network security, security monitoring, and Incident Response fundamentals.
Demonstrated daily use of AI tools and prompt engineering to support security or technical work.
Familiarity with security technologies and services such as threat intelligence, firewalls, IPS, endpoint security, DLP, SIEM/SOAR, and Data Lakes.
Familiarity with security concepts in at least one major cloud platform: AWS, Azure, or GCP.
Understanding of the attack kill chain and the MITRE ATT&CK framework.
Ability to work independently on defined tasks and seek guidance when needed.
Strong verbal and written communication skills and a drive to keep learning.
Must clear a pre-employment drug test.
Must be currently authorized to work in the United States for any employer without current or future sponsorship.

Nice To Haves

Security+, GSEC, GCIA, GCIH, SC-200, AWS Security Specialty, or similar certification(s).
Experience with AI/ML frameworks or building AI-assisted workflows for security applications.
Experience with SOAR automation or scripting, such as Python.
Multi-cloud security experience across AWS, Azure, and GCP.
DevOps, Engineering, Network, or System Administration experience.
Exposure to customer-focused detection and response systems.
Familiarity with the Open Cybersecurity Schema Framework (OCSF).

Responsibilities

Build, test, and maintain detections for Cox Automotive’s internal systems and domestic and international businesses.
Contribute to the Detection Engineering roadmap by delivering assigned work and recommending improvements to senior engineers.
Use AI tools and large language models to accelerate detection development, query writing, log analysis, investigation, and documentation, and validate their output before use.
Build and maintain AI-assisted detection and triage workflows, including prompts, agent steps, and automated enrichment, following established patterns and senior-engineer guidance.
Develop and tune detection rules, automated remediation playbooks, and alerts using SIEM, EDR, and SOAR platforms.
Use MITRE ATT&CK and ATLAS to map detections, assess coverage, and help identify gaps.
Monitor detection performance and tune detections to reduce false positives and improve effectiveness.
Collaborate with the Threat Detection and Response team to improve threat identification and response.
Perform attack simulation testing and support purple teaming exercises with Vulnerability Management.
Support SIEM and Data Lake log ingestion by onboarding log sources, validating parsing and data quality, and troubleshooting ingestion issues.
Evaluate, validate, tune, and recommend retirement of detections as needed.
Collect and report detection metrics, including alert volume, false-positive rates, and coverage.
Create and maintain operational guidelines, diagrams, and documentation for security detection and response.
Participate in an off-hours support rotation for security detection and response activities.
Collaborate with Incident Response to support rapid threat detection and containment; build threat detection logic during incident response with guidance and contribute process improvements based on lessons learned.
Apply threat intelligence to build and enhance detections; research emerging threats and share findings to inform detection priorities.
Partner with Cybersecurity, Engineering, and Product teams to deploy detection and response solutions, including customer-focused solutions with senior-engineer guidance.
Communicate detection capabilities and findings to technical and non-technical stakeholders and escalate issues as needed.
Follow detection and response processes that adhere to regulatory requirements and industry standards, and maintain documentation of detection use cases, processes, and configurations.

Benefits

Flexible paid vacation, subject to duties and company needs.
Seven paid holidays annually.
Up to 160 hours of paid wellness time annually for the employee’s or family members’ wellness.
Bereavement leave.
Time off to vote.
Jury duty leave.
Volunteer time off.
Military leave.
Parental leave.
Potential health care insurance, including medical, dental, and vision coverage.
Potential 401(k) retirement planning.
Potential paid sick leave and other paid days off.