Senior Security Engineer- Security Operations

GE Appliances•Louisville, KY

6h•Onsite

About The Position

GE Appliances is seeking a Senior Security Engineer, Security Operations, to serve as the senior technical lead for the company’s detection and response capability. Day-to-day 24x7 monitoring, alert triage, and vulnerability operations are delivered by a managed security services provider (MSSP). This role is not a shift lead or people manager; it owns the engineering behind the SOC, including detection and response platforms, detection content, automation, and telemetry. The engineer drives continuous improvement in how threats are detected, investigated, and contained across enterprise IT, cloud, and manufacturing (OT) environments. The role is the MSSP’s technical counterpart and escalation point for complex incidents, and is accountable for measurable improvements in detection coverage, fidelity, and response speed. The position is based in Louisville, Kentucky. Working conditions are normal for an office environment, with flexibility to create a work arrangement in partnership with the employee’s leader. Work may occasionally require evenings or weekends, including after-hours escalation for major security incidents and participation in an on-call rotation. GE Appliances describes its culture through its Zero Distance philosophy and commitments to inclusion, diversity, belonging, engagement, and connection. The company is an Equal Opportunity Employer and participates in E-Verify.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience.
6–10 years of progressive experience in IT or information security, including at least 4 years of hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms, such as Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, or CrowdStrike, including writing detection rules and queries such as XQL, SPL, or KQL.
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations; proficiency in Python and/or PowerShell; and experience working with REST APIs and JSON.
Hands-on incident response experience involving significant enterprise incidents such as ransomware, business email compromise, and account takeover, including endpoint, log, and network analysis.
Experience working with an MSSP or MDR provider in a technical oversight role, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of frameworks such as MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills, with the ability to communicate with technical and executive audiences.

Nice To Haves

GIAC certifications such as GCIH, GCIA, GCDA, GCFA, or GCTI; Palo Alto Networks Cortex certifications; CISSP; or similar certifications.
Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
Experience with threat hunting, purple teaming, and adversary emulation tools such as Atomic Red Team, MITRE Caldera, or breach-and-attack simulation platforms.
Familiarity with OT/ICS monitoring and frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations, and familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Responsibilities

Serve as the senior technical lead and subject-matter expert for security operations, owning the architecture, configuration, and operational health of detection and response platforms and setting the technical standards for the MSSP.
Design, build, test, and maintain detection content mapped to MITRE ATT&CK, managing its lifecycle through detection-as-code practices such as version control, testing, peer review, and documentation.
Own telemetry coverage by identifying visibility gaps; onboarding, parsing, and normalizing log sources across endpoints, identity, Microsoft 365, cloud, network, email, DLP, and OT; monitoring ingestion health; and managing data volume and retention cost.
Engineer SOAR playbooks and integrations to enrich alerts, automate containment, connect security tooling with IT service management and collaboration platforms, and reduce manual effort and MSSP handling time.
Provide technical oversight of MSSP output, reviewing triage and investigation quality, escalation accuracy, and run-book adherence; reduce false positives through tuning; and maintain MSSP run books and playbooks as detections and the environment change.
Act as the Tier 3 escalation point and technical lead for complex or high-severity incidents, conducting hands-on investigation, endpoint and log analysis, scoping, and containment, and coordinating with the external incident response retainer when engaged.
Lead hypothesis-driven threat hunts informed by threat intelligence and threats targeting manufacturing, and convert findings into durable detections and hardening recommendations.
Translate threat advisories, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions, and track threat actors relevant to GE Appliances.
Validate detection and response effectiveness through purple-team exercises, adversary emulation, and breach-and-attack simulation; measure MITRE ATT&CK coverage and confirm MSSP detection and response.
Maintain EDR/XDR platform health across endpoints and servers, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen the technical side of MSSP-run vulnerability operations, including scan coverage and authenticated scanning, risk-based prioritization using exploitability and threat intelligence, correlation of vulnerabilities with active threat activity, and remediation workflow automation.
Partner with Cloud, Network, and Identity security engineers to integrate cloud security posture, network, and identity signals into detection and response, including identity threat detection for account takeover, MFA fatigue, and AiTM phishing.
Partner with OT Security to extend monitoring and detection into manufacturing environments safely and consistently with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks, technical run books, and tabletop exercise scenarios; lead the technical portion of post-incident reviews and drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs, including MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, and MSSP escalation quality, to the CISO and Information Security leadership.
Contribute to the security operations roadmap; evaluate emerging capabilities, including AI-assisted triage and investigation and agentic SOC automation; and support platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits, and drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts about the GE Appliances environment, detections, and response procedures.