Cybersecurity Engineer, Detection Engineer

Marathon Petroleum Corporation•San Antonio, TX

8d•Onsite

About The Position

The Senior Cybersecurity Engineer, Cyber Threat Detection plays a critical role in safeguarding Marathon Petroleum Corporation’s digital and operational assets across enterprise IT and industrial control systems (ICS/OT). This position is responsible for engineering and optimizing threat detection logic to identify, analyze, and respond to emerging cyber threats targeting both business and field operations, including refineries, pipelines, terminals, and remote industrial facilities. Working as part of the Cyber Threat Operations team within the Cyber Fusion Center, the engineer will translate complex threat intelligence into high-fidelity detection capabilities, develop automated response workflows, and contribute to the ongoing enhancement of incident response playbooks. The role requires close coordination with internal teams including threat hunting, incident response, threat intelligence, and infrastructure to ensure alignment between detection strategy, risk posture, and operational resiliency. The ideal candidate is technically proficient, collaborative, and mission-driven, with a strong understanding of IT/OT security principles and a passion for protecting critical infrastructure within the energy sector.

Requirements

Bachelor’s Degree in Information Technology, related field or equivalent experience.
Two (2) or more years of relevant experience required.
Hands-on experience with SIEM platforms (e.g., Splunk, Google SecOps, QRadar), detection rule creation, and alert tuning required
Experience with scripting (e.g., Python, PowerShell) and security automation/orchestration tools (e.g., SOAR platforms like Google SecOps, Cortex XSOAR, Splunk SOAR, or Swimlane) required.
Authentic Communicator - Expresses ideas and information, both verbally and in writing, clearly and credibly. Listens to understand and fosters constructive dialogue.
Cybersecurity Risk Management - The process of developing cyber risk assessment and treatment techniques that can effectively pre-empt and identify significant security loopholes and weaknesses, demonstrating the business risks associated with these loopholes and providing risk treatment and prioritization strategies to effectively address the cyber-related risks, threats and vulnerabilities, ensuring appropriate levels of protection, confidentiality, integrity and privacy in alignment with the security framework.
General Programming - Applies a computer language to communicate with computers using a set of instructions and to automate the execution of tasks.
Intrusion Detection - The use of security analytics, including the outputs from intelligence analysis, predictive research and root cause analysis in order to search for and detect potential breaches or identify recognized indicators and warnings. Also, monitoring and collating external vulnerability reports for organizational relevance, ensuring that relevant vulnerabilities are rectified through formal change processes.
Penetration Testing - The practice of testing a computer system, network or web application to find security vulnerabilities that an attacker could exploit. Penetration testing can be automated with software applications or performed manually.
Security Controls - Manages and maintains an information system that focuses on the management of risk and the management of information systems security.
Security Governance - The process of developing and disseminating corporate security policies, frameworks and guidelines to ensure that day-to-day business operations are guarded and well protected against risks, threats and vulnerabilities.
Security Information & Event Management (SIEM) - A set of tools and services offering real-time visibility across an organization's information security systems, and event log management that consolidates data from numerous sources.
Security Policy Management - The process of identifying, implementing, and managing the rules and procedures that all individuals must follow when accessing and using an organization's IT assets and resources.
Threat Analysis - Monitor intelligence-gathering and anticipate potential threats to an IT/OT systems proactively. This involves the pre-emptive analysis of potential perpetrators, anomalous activities and evidence-based knowledge and inferences on perpetrators' motivations and tactics.
Threat Hunting - Searches through networks, endpoints, and datasets to detect and isolate cyber threats that evade existing security solutions.
Vulnerability Management - The process of defining, identifying, classifying and prioritizing vulnerabilities in computer systems, applications and network infrastructures and providing the organization with the necessary knowledge, awareness and risk background to understand the threats to its business.

Nice To Haves

Professional certification, e.g. Security+, Network+, OSCP, GIAC, CEH preferred.
Familiarity with ICS/OT networks and industrial protocols such as Modbus, DNP3, and OPC preferred.
Knowledge of threat frameworks including MITRE ATT&CK and Cyber Kill Chain preferred.

Responsibilities

Clearly understands business requirements and is able to identify risk and risk mitigations.
Resolves routine multi-functional technical issues and supports resolution of complex issues.
Recognizes established Cybersecurity assessments, standards and applies them in practice to security systems.
Contributes to the efficiency and effectiveness of Security solutions, processes and controls in place by building, testing, and maintaining security automation and orchestration workflows to accelerate detection and response across environments
Identifies and provides recommendations towards process improvement and/or solution remediation and assists in developing steps within Standard Operating Procedures.
Identifies business impacting events and performs initial investigation.
Monitors networks, systems, and applications for signs of potential cybersecurity incidents.
Investigates and analyzes the nature and scope of cyber incidents by developing, implementing, and continuously refining cyber threat detection logic across the corporate SIEM/SOAR platform
Analyzes security protocols, administers and maintains security audits and reports of cyber systems access and activity; participates in disaster recovery planning per corporate guidelines.
Delivers and implements global security initiatives, policies, and compliance requirements.
Identifies cybersecurity metrics and applicability for various teams. Takes action through collaboration to improve metric results.
Executes cyber security-related consulting, guidance, and support to customers and stakeholders by documenting detection content, orchestration logic, tuning efforts, and automation workflows for internal knowledge sharing and auditability
Follows emerging Information Technology/Operations Technology and cybersecurity technology trends as well as their impact on the security landscape.