Detection and Automation Engineer

Skechers•Manhattan Beach, CA

4d•$125,000 - $165,000

About The Position

Our Cybersecurity Engineers at Skechers are key members of our global cybersecurity team. This position plays a leading, hands-on role in advancing detection and response capabilities through the development and maintenance of security automation playbooks, detection content, and the tools and infrastructure that support security monitoring and response. You will implement and manage systems for log and event data processing and analysis, prioritize and develop detections based on adversary behaviors, lead purple team exercises, and build automation workflows that incorporate both established logic and emerging AI capabilities to improve analysis, context, and response. While on the front lines of our global cyber defense practice, you will act as an escalation point for incidents and alerts, while working proactively to identify and resolve cybersecurity issues. The role will involve working closely with infrastructure, application, and business teams globally to improve telemetry, validate defensive capabilities, and help facilitate secure operations. This is a great opportunity for someone looking to join an agile cybersecurity team with an eye for innovation and a continuous improvement mindset. The candidate who will find the most success and fulfillment brings a genuine interest and passion for cybersecurity, a love for learning, a positive attitude, and a desire to roll up their sleeves and dive into the deep end.

Requirements

Advanced experience with event log management, aggregation, alerting, and monitoring
Demonstrated experience developing, tuning, testing, and documenting detection rules and alerts, with working knowledge of adversary tactics, techniques, and procedures.
Experience with SOAR or similar automation platforms, APIs, webhooks, and scripting languages such as Python or PowerShell
Deep understanding of security concepts relating to identity and access management, network architecture, and systems hardening in a large heterogeneous environment
Experience working with servers and workstations running Windows, Linux, and macOS
Strong experience with public cloud services (AWS, Azure, GCP) a plus
Excels in developing and maintaining effective working relationships while remaining focused on the task at hand
Ability to excel in a fast-paced and rapidly changing environment
Strong analytical and problem-solving skills, with attention to detail and the ability to follow evidence
Strong documentation habits with excellent written and oral communication skills
Assumes a lead role in cybersecurity projects, incident response, and developing new concepts
Ability to simplify and communicate complex technical data and concepts in an understandable format
Mentors junior team members and shares technical knowledge across the team
Strong working knowledge in cybersecurity, systems, cloud, or network engineering
5+ years of experience in a dedicated cybersecurity role, or a combination of equivalent information technology experience, training, and education

Nice To Haves

GIAC, (ISC)2, or equivalent certifications a plus

Responsibilities

Source, integrate, and leverage log and event data to create insights and develop queries, detections, and dashboards
Prioritize, develop, test, tune, and maintain detection logic, rules, and alerts based on threat intelligence, attack techniques, and knowledge of adversary behavior
Develop and maintain clear documentation of detection logic, data requirements, test results, tuning decisions, alert handling, and response procedures
Improve the quality and usability of security telemetry by evaluating source integrations, parsing, normalization, enrichment, field mappings, and logging practices to ensure the data supports effective detection and investigation.
Drive regular threat hunting and purple team exercises and translate findings into measurable detection and response improvements
Design, build, and continuously improve security automation playbooks that blend deterministic actions with AI-assisted analysis and actions
Manage and maintain the security tools and supporting infrastructure used for log processing, detection engineering, orchestration, and response automation
Triage alerts and reports received from various sources and perform incident response in real time as needed
Evaluate, deploy, and maintain innovative security tools, technology, and systems
Collaborate to define cybersecurity standards and develop secure procedures
Work closely with multiple global groups and business units to provide guidance and support
Perform regular security and vulnerability reviews and participate in periodic security and compliance audits
Stay current with the changing threat landscape, detection engineering and automation practices, AI capabilities and limitations, and defensive technologies.