Lead Detection & Response Platform Engineer

CoStar Group•Arlington, VA

8d•Hybrid

About The Position

CoStar Group is seeking a Lead Detection & Response Platform Engineer to own and engineer the platform used by CoStar Security to triage alerts and respond to incidents. The platform includes SIEM, XDR, SOAR and case-management tools, along with the integrations, automation and content that connect them. The role defines standards for alert triage and incident response, builds those processes into the platform, measures performance and improves the processes and platform based on results. It is not a tool-administration or software-engineering role. The successful candidate combines security operations expertise with engineering skills and communicates security concepts and decisions clearly to technical and non-technical audiences across the enterprise. The position coordinates incident response across the business and mentors analysts and engineers so they can design and automate their own work. It is based in Arlington or Richmond, Virginia, with in-office work Monday through Thursday and work from home on Friday, and participation in a 24x7 on-call rotation.

Requirements

Bachelor’s degree from an accredited, not-for-profit, in-person university or college.
A track record of commitment to prior employers.
One or more security certifications, such as GIAC GCIH, GCDA, CISSP, CISM or ECIH.
8+ years of IT experience, including 5+ years in cybersecurity and at least 3 years in security operations, detection engineering or incident response.
Experience designing and running alert triage or incident response processes for an enterprise security operations team.
Experience building and maintaining production security automation in a SOAR or workflow platform, including playbooks, API integrations and enrichment.
Proficiency in Python or PowerShell, REST APIs and JSON.
Proficiency in at least one SIEM query language, such as KQL or SPL.
Experience managing security content or configuration with Git and a change-control process.
Experience investigating identity (Active Directory / Entra ID), endpoint, cloud and email telemetry.

Nice To Haves

Experience with the Microsoft security stack, including Sentinel, Defender XDR, Logic Apps and Entra ID.
Experience with detection-as-code or CI/CD pipelines for SIEM content, and infrastructure as code such as Terraform or Bicep/ARM.
Experience investigating in Azure and AWS, including use of cloud security posture tools.
Experience using LLMs in security workflows and ability to explain their limits and failure modes.
Experience defining security operations metrics and reporting them to leadership.
Working knowledge of NIST SP 800-61, MITRE ATT&CK and a SOC maturity model such as SOC-CMM.
Experience mentoring staff or building internal training.
Clear technical writing skills for runbooks, standards and post-incident reports.

Responsibilities

Own and document alert triage standards, including classification, enrichment, prioritization, investigation, escalation and closure.
Build triage processes into SOAR playbooks, enrichment pipelines and case-management workflows to reduce repetitive work and ensure consistent handling.
Operate the SIEM, XDR, SOAR and case-management stack as a platform; manage configuration, content and integrations under version control with peer review, testing and automated deployment.
Measure alert volume, true and false positive rates, time to triage and contain, and automation coverage; use the data to tune, automate or retire processes and content.
Partner with detection engineering and threat intelligence to ensure detections include triage guidance, enrichment and response actions, and feed triage lessons back into tuning.
Evaluate AI- and LLM-assisted triage, enrichment and case summaries; adopt them where they measurably reduce analyst effort, with human review and defined guardrails.
Coordinate incident response across business units, lead significant incidents, coordinate technical, business and legal stakeholders, and track post-incident corrective actions to completion.
Maintain the Incident Response Plan and run quarterly tabletop exercises, translating findings into updated playbooks and automation.
Mentor analysts and engineers in process design, investigation methods and automation; review playbooks, queries and code.
Connect identity, endpoint, cloud, email and network telemetry and tools through APIs, and address data-quality and coverage gaps that slow triage.
Use MITRE ATT&CK to map detection and response coverage and establish threat-hunting priorities.
Participate in a 24x7 on-call rotation.

Benefits

Comprehensive healthcare coverage, including medical, vision, dental and prescription drug coverage.
Life, legal and supplementary insurance.
Virtual and in-person mental health counseling services for individuals and family.
Commuter and parking benefits.
401(k) retirement plan with matching contributions.
Employee stock purchase plan.
Paid time off.
Tuition reimbursement.
On-site fitness center and/or reimbursed fitness center membership costs, depending on location.
Access to CoStar Group’s Employee Resource Groups.
Complimentary gourmet coffee, tea, hot chocolate, fresh fruit and other healthy snacks.
Generous compensation and performance-based incentives.
Internal training and investment in professional and academic growth.