Senior Detection & Response Engineer

ZeniMax Media, Inc.•Rockville, MD

73d•$80,000 - $180,000•Hybrid

About The Position

ZeniMax Media, part of Microsoft Gaming, is seeking a highly skilled and motivated Senior Engineer - Threat Detection & Incident Response to join our Gaming Security team. This U.S.-based remote or hybrid position plays a critical role in protecting our studios, platforms, and player communities across a diverse gaming ecosystem. You will lead efforts to design and optimize advanced detection capabilities, respond to complex security incidents, and drive strategic improvements in threat visibility and response operations.

Requirements

Bachelor's or Master's degree in Cybersecurity, Computer Science, or a related field, or equivalent professional experience (typically 6+ years, including at least 4 years focused on threat detection and incident response).
Deep expertise in SIEM platforms (e.g., Microsoft Sentinel) and M365 Security Suite (Defender for Endpoint, Defender for Identity, Defender for Cloud Apps).
Strong understanding of adversary tactics, techniques, and procedures (TTPs) mapped to MITRE ATT&CK.
Demonstrated experience leading investigations and performing forensic or behavioral analysis.
Practical experience with cloud environments (Azure, AWS, GCP) and associated security telemetry.
Excellent written, verbal, and interpersonal communication skills.

Nice To Haves

Experience in hybrid or Cloud Security operations environments.
Familiarity with AI-assisted detection and automation technologies to improve rule tuning, triage, and response speed.
Relevant industry certifications (e.g., GCIA, GCIH, GMON, or Azure Security Engineer).
Background in malware analysis, reverse engineering, or development of custom detection frameworks.
Passion for mentoring, knowledge-sharing, and driving innovation in cybersecurity practices.
Flexibility to support global operations, including shift work, holidays/weekends, and occasional travel.
Proactive, ownership-driven mindset with willingness to volunteer for high-impact tasks or assist in major incidents beyond assigned scope.

Responsibilities

Design, fine-tune, and maintain high-fidelity detection content and alerting logic across SIEM and SOC platforms, minimizing false positives and alert fatigue.
Leverage scripting and automation (Python, PowerShell, etc.) to enhance detection coverage, accelerate response workflows, and improve operational efficiency.
Apply threat intelligence, adversary simulation, and behavioral analytics (MITRE ATT&CK) to identify detection gaps and drive continuous improvement.
Partner with infrastructure, application, and cloud engineering teams to embed detection capabilities in new and existing systems.
Monitor and analyze security events for potential risks or anomalies.
Lead investigations and perform end-to-end incident response, including containment, eradication, and post-incident reviews.
Conduct forensic analysis and log correlation to reconstruct attack paths and identify root causes.
Develop playbooks, standard operating procedures (SOPs), and knowledge articles to institutionalize response processes.
Work cross-functionally with teams such as Legal, Game Security, Player Support, and Corporate Engineering to ensure comprehensive risk visibility and response alignment.
Provide technical leadership in evaluating detection and response tools, shaping detection architecture, and executing strategic security initiatives.
Participate in on-call rotations and global incident response operations, including potential travel for events or escalations.

Benefits

U.S.-based employees have access to healthcare benefits, a 401(k) plan and company match, short-term and long-term disability coverage, basic life insurance, wellbeing benefits, paid vacation time, paid sick and mental health time, and several paid holidays, among others.

Stand Out From the Crowd

Upload your resume and get instant feedback on how well it matches this job.

Upload and Match Resume