Cybersecurity Engineer III, Detection and Response

Upbound Group • Plano, TX

10d • Onsite

About The Position

The Cybersecurity Engineer III, Detection and Response strengthens Upbound's Security Operations capabilities through detection engineering, AI-assisted security operations, incident response, threat hunting, and security telemetry engineering. This senior technical contributor builds, tests, and maintains security monitoring across cloud, identity, endpoint, network, SaaS, and AI-enabled environments. The role uses modern AI technologies in daily security operations, with validation, data protection safeguards, and human oversight to improve investigative speed and effectiveness.

The position partners with application, infrastructure, cloud, engineering, product, and managed security teams to establish security logging requirements, implement reliable ingestion pipelines, develop actionable detections, assess operational security requirements for new projects and products, and improve security capabilities. The role also supports vulnerability validation and remediation, security automation, documentation, runbooks, and operational metrics.

The position requires onsite work five days a week, Monday through Friday, in Plano, Texas, with travel between locations as necessary. Candidates must be authorized to work in the United States without employment-based immigration sponsorship, including OPT or CPT.

Requirements

• Five or more years of relevant experience spanning security operations, detection engineering, and incident response, with the ability to independently handle complex investigations and develop security detections; equivalent demonstrated capability will be considered.
• Hands-on experience with modern SIEM and XDR platforms, including detection development, correlation logic, security query languages, and techniques for testing and tuning detections.
• Practical experience conducting threat hunts and investigating security activity across identity, endpoint, cloud, and SaaS environments, including Microsoft Entra ID, Microsoft 365, AWS, and Azure.
• Demonstrated experience using modern AI technologies for security investigations, detection engineering, or automation, including the ability to validate AI-generated outputs and recognize their limitations.
• Proficiency with Python, APIs, and security telemetry integrations, including log ingestion, parsing, normalization, and troubleshooting.
• Working knowledge of vulnerability assessment and exploitability validation.
• Strong analytical, technical documentation, and communication skills for engineering and executive audiences.
• Authorization to work in the United States without sponsorship; Upbound Group does not offer employment-based immigration sponsorship, including OPT or CPT.
• Ability to work onsite in Plano, Texas, Monday through Friday, and travel between locations as necessary.

Nice To Haves

• Experience with detections as code, source control, automated detection testing, and deployment pipelines.
• Experience developing AI agents, AI-assisted investigation workflows, or security orchestration and automated response capabilities.
• Familiarity with adversary emulation, purple team exercises, offensive security testing, or threat modeling.
• Experience with infrastructure as code, configuration management, and automated deployment or validation of security integrations.
• Relevant certifications such as CompTIA Security+, GIAC GCIH, GCIA or GCED, Microsoft SC-200, AWS Certified Security – Specialty, or CISSP; equivalent practical expertise is valued.

Responsibilities

• Design, develop, test, and tune security detections as code; map use cases to MITRE ATT&CK and validate effectiveness through adversary emulation, offensive testing, or controlled simulations.
• Build and operate AI-assisted security workflows, including investigation agents, automated triage, detection development, and response playbooks, with human decision points, accuracy checks, and data protection safeguards.
• Conduct proactive threat hunting across identity, endpoint, network, cloud, and SaaS environments using threat intelligence and attacker techniques to identify suspicious activity and detection gaps.
• Independently investigate complex security incidents, including identity-based attacks, and coordinate technical containment, root cause analysis, remediation, and post-incident reviews.
• Engineer and maintain reliable SIEM logging pipelines across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, including ingestion, parsing, normalization, integration troubleshooting, telemetry quality, and logging requirements for new projects and products.
• Validate critical and known-exploited vulnerabilities using assessment results, exploitability information, and system evidence; coordinate remediation verification and implement compensating detections while fixes are underway.
• Partner with application, infrastructure, cloud, product, and managed security teams to assess security monitoring requirements, improve detection quality, operationalize security capabilities, and support technical security reviews.
• Develop security automation, maintain technical documentation and runbooks, and contribute to operational metrics covering detection and containment times, priority detection coverage, automation accuracy, and exploitable exposure age.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed