Senior Security Engineer- Security Operations

GE Appliances, a Haier company•Louisville, KY

1d•Onsite

About The Position

GE Appliances is seeking a Senior Security Engineer, Security Operations, to serve as the senior technical lead for the company’s detection and response capability. Day-to-day 24x7 monitoring, alert triage, and vulnerability operations are delivered by a managed security services provider (MSSP). This role is not a shift lead or people manager; it owns the engineering behind the SOC, including detection and response platforms, detection content, automation, and telemetry. The engineer drives continuous improvement in how threats are detected, investigated, and contained across enterprise IT, cloud, and manufacturing (OT) environments, acts as the MSSP’s technical counterpart and escalation point for complex incidents, and is accountable for measurable improvements in detection coverage, fidelity, and response speed. The role provides technical oversight of the MSSP, engineers detections and SOAR automation, manages telemetry and EDR/XDR health, and leads complex incident investigations and threat hunts. It also partners with Cloud, Network, Identity, and OT Security teams; validates capabilities through purple-team exercises and adversary emulation; supports vulnerability operations, audits, and the security operations roadmap; and reports operational metrics to security leadership. The position is based in Louisville, Kentucky. Working conditions are normal for an office environment, with occasional weekend or evening work, after-hours escalation for major security incidents, and participation in an on-call rotation. Flexible work arrangements may be developed with the employee’s leader based on business and individual needs.

Requirements

Bachelor’s degree in Information Systems, Cybersecurity, Computer Science, or a related technical field, or equivalent practical experience.
6–10 years of progressive experience in IT or information security, including at least 4 years of hands-on experience in security operations, detection engineering, or incident response in a large enterprise environment.
Deep hands-on experience engineering and administering SIEM/SOAR and EDR/XDR platforms, such as Palo Alto Networks Cortex XSIAM/XDR, Splunk, Microsoft Sentinel/Defender, or CrowdStrike, including writing detection rules and queries such as XQL, SPL, or KQL.
Proven experience building detection content mapped to MITRE ATT&CK and tuning it for fidelity at enterprise scale.
Experience building SOAR playbooks and integrations, with proficiency in Python and/or PowerShell and experience working with REST APIs and JSON.
Hands-on incident response experience with significant enterprise incidents, such as ransomware, business email compromise, and account takeover, including endpoint, log, and network analysis.
Experience working with an MSSP or MDR provider in a technical oversight role, including tuning, escalation quality review, and run-book development.
Strong understanding of log sources and telemetry across Windows, Linux, network, cloud (AWS, Azure, and/or GCP), Microsoft 365, and identity providers.
Working knowledge of MITRE ATT&CK, NIST SP 800-61, NIST CSF, and CIS Controls.
Excellent verbal and written communication skills, with the ability to communicate with technical and executive audiences.

Nice To Haves

GIAC certifications (e.g., GCIH, GCIA, GCDA, GCFA, GCTI), Palo Alto Networks Cortex certifications, CISSP, or similar.
Experience with detection-as-code practices, Git, CI/CD pipelines, and vendor-neutral rule formats such as Sigma.
Experience with threat hunting, purple teaming, and adversary emulation tools such as Atomic Red Team, MITRE Caldera, or breach-and-attack simulation platforms.
Familiarity with OT/ICS monitoring and frameworks such as ISA/IEC 62443 or NIST SP 800-82.
Experience integrating cloud security (CNAPP/CSPM) and identity telemetry into detection and response.
Experience applying AI and large language models to security operations, and familiarity with AI security frameworks such as MITRE ATLAS and the OWASP Top 10 for LLM Applications.
Experience in manufacturing, critical infrastructure, or global multinational organizations.

Responsibilities

Serve as the senior technical lead and subject-matter expert for security operations, owning detection and response platform architecture, configuration, operational health, and technical standards for the MSSP.
Design, build, test, and maintain MITRE ATT&CK-mapped detection content, managing its lifecycle through detection-as-code practices.
Own telemetry coverage by identifying visibility gaps, onboarding and normalizing log sources, monitoring ingestion health, and managing data volume and retention cost.
Engineer SOAR playbooks and integrations to enrich alerts, automate containment, connect security tools with IT service management and collaboration platforms, and reduce manual effort.
Provide technical oversight of MSSP triage, investigations, escalations, run-book adherence, false-positive reduction, and tuning; maintain MSSP run books and playbooks.
Act as the Tier 3 escalation point for complex or high-severity incidents, performing investigation, endpoint and log analysis, scoping, and containment, and coordinating with an external incident response retainer when engaged.
Lead hypothesis-driven threat hunts informed by threat intelligence and manufacturing-sector threats; convert findings into detections and hardening recommendations.
Translate threat intelligence, vulnerability disclosures, and adversary reporting into detections, hunts, and blocking actions, and track relevant threat actors.
Validate detection and response effectiveness through purple-team exercises, adversary emulation, and breach-and-attack simulation, measuring MITRE ATT&CK coverage and MSSP performance.
Maintain EDR/XDR platform health across endpoints and servers, including agent coverage, prevention and exploit-protection policies, exclusions governance, and response actions.
Strengthen vulnerability operations by improving scan coverage and authenticated scanning, risk-based prioritization, vulnerability-to-threat correlation, and remediation workflow automation.
Partner with Cloud, Network, and Identity security engineers to integrate CNAPP, network, and identity signals into detection and response, including identity threat detection.
Partner with OT Security to extend monitoring and detection into manufacturing environments safely and in alignment with ISA/IEC 62443 and NIST SP 800-82.
Author and maintain incident response playbooks, technical run books, and tabletop exercise scenarios; lead the technical portion of post-incident reviews and drive corrective actions to closure.
Define, automate, and report operational metrics and KPIs, including MTTD, MTTR, ATT&CK detection coverage, false-positive rate, log source health, and MSSP escalation quality, to the CISO and Information Security leadership.
Contribute to the security operations roadmap; evaluate emerging capabilities, including AI-assisted triage and agentic SOC automation; and support platform evaluations, proofs of concept, and TCO analyses.
Provide technical evidence for logging, monitoring, and incident response controls in SOX, C-SOX, PCI-DSS, and other audits, and drive remediation of related findings.
Mentor engineers and transfer knowledge to MSSP analysts on the GE Appliances environment, detections, and response procedures.