IT Security Engineer IV
About The Position
The Security Incident Response & Detection Engineer IV administers and enhances the ServiceNow Security Incident Response (SIR) module in a production SOC environment, including incident workflows, assignment and escalation rules, SLAs, forms, user interface configuration, and integrations with SIEM, SOAR, and threat intelligence sources. The role develops and maintains Detection-as-Code (DaC) pipelines, including detection development, version control, CI/CD testing, and automated deployment. It also develops and tunes detections across endpoint, cloud, network, email, and DLP telemetry; builds SOAR playbooks and API integrations; and supports optimization of the SIEM/SOAR platform stack. The engineer contributes to AI SOC initiatives such as expanding investigation coverage, automating alert triage, and monitoring integration health. Detection content must use MITRE ATT&CK mapping, false-positive-rate gating, and detection lifecycle standards. The role partners with SOC analysts and incident response teams to translate operational gaps into engineering solutions. Work is expected to follow a hybrid schedule in Frisco, Texas, or San Diego, California. The position is listed for a duration of six or more months, with the possibility of extension.
Requirements
- Demonstrated SOC experience in detection engineering, security engineering, or a senior analyst capacity, with an engineering mindset.
- Hands-on experience administering the ServiceNow Security Incident Response module, including configuring workflows, business rules, assignment logic, and SIEM/SOAR/API integrations in a production SOC environment.
- Hands-on automation and scripting experience, primarily with Python.
- Experience building or contributing to Detection-as-Code pipelines.
- Strong grounding in MITRE ATT&CK, the Pyramid of Pain, the Cyber Kill Chain, and incident response processes and phases.
- Deep understanding of at least one of endpoint security (macOS and Windows internals, telemetry, and detection) or cloud infrastructure (cloud-native services, Kubernetes, and runtime detection).
- Solid networking fundamentals, including DNS.
- Working knowledge of IAM, SSO (SAML/OIDC), and Zero Trust architecture concepts.
- Working knowledge of Data Loss Prevention concepts and detection use cases.
- Understanding of AI Detection & Response, including securing and monitoring enterprise AI/LLM usage.
- Bachelor’s degree in an IT-related or Engineering field.
Nice To Haves
- ServiceNow certifications relevant to the platform, such as Certified System Administrator, or Security Incident Response implementation experience.
- Experience with CI/CD tooling such as Git and GitHub Actions for security content deployment.
- Experience integrating AI/LLM capabilities into SOC triage or detection pipelines.
- Familiarity with Risk-Based Alerting concepts.
- Familiarity with agentic AI frameworks and applying AI to SOC operations and detection engineering workflows.
Responsibilities
- Administer and enhance the ServiceNow Security Incident Response module, including incident workflows, assignment and escalation rules, SLAs, forms, UI configuration, and integrations.
- Design, build, and maintain the Detection-as-Code pipeline, including detection development, version control, CI/CD testing, and automated deployment.
- Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
- Build SOAR playbooks, API integrations, and automation to streamline SOC workflows.
- Support administration and optimization of the SIEM/SOAR platform stack.
- Contribute to AI SOC initiatives, including investigation coverage expansion, alert triage automation, and integration health.
- Apply MITRE ATT&CK mapping, false-positive-rate gating, and detection lifecycle standards to deployed content.
- Partner with SOC analysts and incident response teams to turn operational gaps into engineering solutions.
Benefits
- Eligible employees are offered medical, dental, and vision coverage.
- Supplemental coverage, including accident insurance, critical illness insurance, and hospital indemnity.
- 401(k) retirement savings plan.
- Life and disability insurance.
- Employee assistance program.
- Identity theft protection.
- Legal support.
- Auto and home insurance.
- Pet insurance.
- Employee discounts with preferred vendors.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Career Level
Senior
