Lead Detection & Response Platform Engineer

CoStar Group•Arlington, VA

1d•$155,000 - $245,000•Hybrid

About The Position

CoStar Group is hiring a Lead Detection & Response Platform Engineer to own and engineer the platform used by CoStar Security to triage alerts and respond to incidents. The platform includes SIEM, XDR, SOAR, case-management tools, and the integrations, automation, and content that connect them. The role defines how alerts are triaged, investigated, and escalated, then builds those processes into the platform so they are consistent and auditable. The position also communicates security concepts and decisions to technical and non-technical audiences across the enterprise. This is neither a tool-administration nor a software-engineering role. The successful candidate will set standards for triage and incident response, measure platform performance, and improve processes and tooling based on data. The role includes mentoring analysts and engineers, coordinating incident response across the business, and applying security operations expertise and engineering skills to make the platform effective. The position can be located in Arlington or Richmond, Virginia. It is in the office Monday through Thursday and work from home on Friday, and participates in a 24x7 on-call rotation.

Requirements

Bachelor’s degree from an accredited, not-for-profit, in-person university or college.
A track record of commitment to prior employers.
One or more security certifications, such as GIAC GCIH, GCDA, CISSP, CISM, or ECIH.
At least 8 years of IT experience, including at least 5 years in cybersecurity and at least 3 years in security operations, detection engineering, or incident response.
Experience designing and running alert-triage or incident-response processes for an enterprise security operations team.
Experience building and maintaining production security automation in a SOAR or workflow platform, including playbooks, API integrations, and enrichment.
Proficiency in Python or PowerShell, and experience working with REST APIs and JSON.
Proficiency in at least one SIEM query language, such as KQL or SPL.
Experience managing security content or configuration with Git and a change-control process.
Experience investigating identity (Active Directory / Entra ID), endpoint, cloud, and email telemetry.

Nice To Haves

Experience with the Microsoft security stack, including Sentinel, Defender XDR, Logic Apps, and Entra ID.
Experience with detection-as-code or CI/CD pipelines for SIEM content, and infrastructure as code such as Terraform or Bicep/ARM.
Experience investigating in Azure and AWS, including use of cloud security posture tools.
Experience using LLMs in security workflows and ability to explain their limits and failure modes.
Experience defining security operations metrics and reporting them to leadership.
Working knowledge of NIST SP 800-61, MITRE ATT&CK, and a SOC maturity model such as SOC-CMM.
Experience mentoring staff or building internal training.
Clear technical writing skills, including runbooks, standards, and post-incident reports.

Responsibilities

Own the alert triage process by defining how alerts are classified, enriched, prioritized, investigated, escalated, and closed, and documenting auditable standards for analysts.
Build triage processes into SOAR playbooks, enrichment pipelines, and case-management workflows to reduce repetitive work and ensure consistent handling.
Operate the detection and response stack—SIEM, XDR, SOAR, and case management—as a platform, managing configuration, content, and integrations under version control with peer review, testing, and automated deployment.
Measure triage and response performance, including alert volume, true and false positive rates, time to triage and contain, and automation coverage; use the data to determine what to tune, automate, or retire.
Partner with detection engineering and threat intelligence so each new detection includes triage guidance, enrichment, and response actions, and feed triage lessons back into tuning.
Evaluate AI- and LLM-assisted triage, enrichment, and case summaries, adopting them only when they measurably reduce analyst effort and have human review and defined guardrails.
Coordinate incident response across business units, lead significant incidents, coordinate technical, business, and legal stakeholders, and follow corrective actions through completion.
Maintain the Incident Response Plan and conduct quarterly tabletop exercises, using findings to update playbooks and automation.
Mentor and develop analysts and engineers in process design, investigation methods, and automation; review playbooks, queries, and code to help the team build its own automation.
Connect identity, endpoint, cloud, email, and network telemetry and tools through APIs, and address data-quality and coverage gaps that slow triage.
Use MITRE ATT&CK to map detection and response coverage and set threat-hunting priorities.
Participate in a 24x7 on-call rotation.

Benefits

Generous compensation and performance-based incentives.
Internal training and tuition reimbursement to support professional and academic growth.
Comprehensive medical, vision, dental, and prescription drug coverage.
Life, legal, and supplementary insurance.
Virtual and in-person mental health counseling services for individuals and family.
Commuter and parking benefits.
401(k) retirement plan with matching contributions.
Employee stock purchase plan.
Paid time off.
On-site fitness center and/or reimbursement for fitness center membership costs, depending on location.
Access to CoStar Group’s Employee Resource Groups.
Complimentary gourmet coffee, tea, hot chocolate, fresh fruit, and other healthy snacks.