Lead Cybersecurity Engineer (Hybrid)

American Family Insurance•Boston, MA

2d•$113,000 - $194,000•Hybrid

About The Position

American Family Insurance is seeking a Lead Cybersecurity Engineer to drive the engineering and automation of next-generation security operations. This hands-on leadership role builds scalable security solutions through data engineering, detection engineering, and SOAR orchestration, using technologies such as Cortex XSOAR, Python, SQL/KQL, REST APIs, and security analytics platforms. The role leads automation initiatives, integrates security tools, and develops repeatable detection and response capabilities to improve analyst efficiency and strengthen the organization's security posture. The position reports to the Senior Manager Cybersecurity - Cyber Threat Defense. It is a hybrid role requiring work from the Boston, MA or Madison, WI office at least 10 days per month. Travel is up to 10%. The position is not eligible for sponsorship. Relocation support is offered for eligible candidates.

Requirements

Demonstrated experience providing customer-driven solutions, support, or service.
Solid knowledge and understanding of software engineering architectures, system/software designs, and system deployments.
Working knowledge of Cyber Security, Cyber Engineering, Computer Science, Software Engineering, and Electrical/Computer Engineering.
Extensive knowledge and understanding of security technologies and application development methodologies.
Demonstrated experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.
Extensive knowledge and understanding of directory services and identity stores.

Nice To Haves

Experience building and managing security data pipelines across SIEM, EDR, cloud, identity, and threat intelligence platforms.
Hands-on experience with Cortex XSOAR or other SOAR platforms, including playbook and workflow automation.
Proficiency in Python, SQL/KQL, REST APIs, and security tool integrations.
Experience with security analytics platforms such as Microsoft Sentinel, Splunk, Datadog, or similar technologies.
Strong background in detection engineering, threat hunting, and security analytics.
Experience automating security operations to improve response times and analyst efficiency.
Knowledge of MITRE ATT&CK, adversary emulation, and threat-informed defense practices.
Experience leveraging AI-driven capabilities to enhance detection, investigation, and response workflows.
Proven ability to deliver scalable, repeatable security capabilities across engineering and operations teams.
Experience leading technical initiatives and mentoring cybersecurity engineers.

Responsibilities

Lead the design, development, and continuous improvement of cyber defense capabilities across threat detection, threat hunting, incident response, and adversary simulation.
Design, build, and maintain scalable security data pipelines that ingest, normalize, enrich, and analyze data from SIEM, EDR, cloud, identity, and threat intelligence platforms.
Develop and optimize security analytics, detections, correlation rules, and threat hunting methodologies to identify advanced threats and emerging attack techniques.
Design, implement, and maintain security automation and orchestration capabilities using Cortex XSOAR and other SOAR technologies, including automated investigation, enrichment, response, containment, and remediation workflows.
Integrate security technologies through APIs, workflow automation, and data engineering practices to streamline operations and improve analyst efficiency and response times.
Build and maintain reusable automation frameworks, scripts, and services using Python, REST APIs, SQL/KQL, and other modern development techniques.
Conduct proactive threat hunting, adversary emulation, and validation exercises to assess security control effectiveness.
Collaborate with engineering, cloud, infrastructure, identity, and security teams to improve telemetry quality, data availability, and operational resilience.
Leverage AI-driven security capabilities and advanced analytics to enhance detection accuracy, automate repetitive tasks, and improve security operations.
Evaluate, implement, and optimize security monitoring and analytics platforms, including Datadog, Microsoft Sentinel, and Splunk.
Provide technical leadership and mentorship for detection engineering, security automation, and threat response initiatives while driving best practices and continuous improvement.