Cybersecurity Detection Engineer II -

Cox Enterprises•Atlanta, GA

1d•$89,400 - $134,000•Hybrid

About The Position

Cox Automotive is seeking a Cybersecurity Engineer II to join its Detection Engineering team, supporting next-generation Cyber Defense across its automotive businesses. Reporting to the Director of Cyber Detection Engineering, this individual builds, tunes, and maintains enterprise- and customer-focused detection capabilities, including AI-assisted workflows and automation, with guidance from senior engineers. The role works closely with Incident Response, Threat Intelligence, and Vulnerability Management to strengthen detection coverage. The engineer develops and tests detections, rules, alerts, and automated remediation playbooks using SIEM, EDR, and SOAR platforms; maps coverage using MITRE ATT&CK and ATLAS; supports log-source onboarding and ingestion quality; and measures detection performance. The position also contributes to incident response, threat-intelligence integration, purple teaming, attack simulation, stakeholder collaboration, and documentation. Participation in an off-hours support rotation is required.

Requirements

Bachelor’s degree in a related discipline and 2 years of experience in a related field; alternatives include a master’s degree and up to 2 years of experience, or 14 years of related experience.
At least 1 year of experience in Detection Engineering or a Security Operations Center (SOC) role.
Working knowledge of detection concepts, including searching and writing logic with a SIEM query language such as SPL or KQL.
Hands-on experience with a SIEM, including searching and analyzing log data.
Working knowledge of information security, network security, security monitoring, and Incident Response fundamentals.
Demonstrated daily use of AI tools and prompt engineering to support security or technical work.
Familiarity with security technologies and services such as threat intelligence, firewalls, IPS, endpoint security, DLP, SIEM/SOAR, and Data Lakes.
Familiarity with security concepts in at least one major cloud platform: AWS, Azure, or GCP.
Understanding of the attack kill chain and the MITRE ATT&CK framework.
Ability to work independently on defined tasks and seek guidance when needed.
Ability to communicate effectively with technical and non-technical stakeholders.
Must clear a pre-employment drug test. The company does not currently test for marijuana before employment in this role; workplace restrictions on drugs illegal under federal or state law apply.
Must be currently authorized to work in the United States for any employer without current or future sponsorship; OPT, CPT, STEM/OPT, and visa sponsorship are not available.

Nice To Haves

Security+, GSEC, GCIA, GCIH, SC-200, AWS Security Specialty, or similar certification.
Experience with AI/ML frameworks or building AI-assisted workflows for security applications.
Experience with SOAR automation or scripting, such as Python.
Multi-cloud security experience across AWS, Azure, or GCP.
DevOps, engineering, network, or system administration experience.
Exposure to customer-focused detection and response systems.
Familiarity with the Open Cybersecurity Schema Framework (OCSF).

Responsibilities

Build, test, and maintain detections protecting Cox Automotive’s internal systems and domestic and international businesses.
Contribute to the Detection Engineering roadmap by delivering assigned work and recommending improvements.
Use AI tools and large language models for detection development, query writing, log analysis, investigation, and documentation, and validate their output.
Build and maintain AI-assisted detection and triage workflows, following established patterns and senior-engineer guidance.
Develop and tune detection rules, automated remediation playbooks, and alerts using SIEM, EDR, and SOAR platforms.
Map detections, assess coverage, and help identify gaps using MITRE ATT&CK and ATLAS.
Monitor and tune detection performance to reduce false positives and improve effectiveness.
Collaborate with the Threat Detection and Response team to improve threat identification and response.
Perform attack simulation testing and support purple teaming exercises with Vulnerability Management.
Support SIEM/Data Lake log ingestion by onboarding sources, validating parsing and data quality, and troubleshooting ingestion issues.
Evaluate, validate, tune, and recommend retirement of detections as needed.
Collect and report detection metrics, including alert volume, false-positive rates, and coverage.
Build and maintain operational guidelines, diagrams, and documentation for security detection and response.
Participate in an off-hours support rotation for security detection and response.
Collaborate with Incident Response to support rapid threat detection and containment, build detection logic during incidents, and improve processes using lessons learned.
Apply threat intelligence to build and enhance detections, research emerging threats, and share findings with the team.
Partner with Cybersecurity, Engineering, and Product teams to deploy detection and response solutions, including customer-focused solutions.
Communicate detection capabilities and findings to technical and non-technical stakeholders and escalate issues as needed.
Follow detection and response processes that adhere to regulatory requirements and industry standards, including GDPR, PCI-DSS, and NIST.
Maintain documentation of detection use cases, processes, and configurations.

Benefits

Flexible paid vacation.
Seven paid holidays per calendar year.
Up to 160 hours of paid wellness time annually.
Bereavement leave.
Time off to vote.
Jury duty leave.
Volunteer time off.
Military leave.
Parental leave.
Health care insurance, which may include medical, dental, and vision coverage.
401(k) retirement planning.
Paid days off, including sick leave and flexible vacation/wellness days and/or PTO.