Sr Detection and Response Engineer, Information Security

CommScope Inc. • Charlotte, NC

2d

About The Position

CommScope is seeking a Senior Detection and Response Engineer to serve as a hands-on L3 technical lead and escalation point in its Security Operations Center. The role owns complex investigations and incident response end to end, while building detections, automations, and AI-assisted workflows to help a lean team operate at scale. The engineer works closely with the MDR partner and junior analysts, translating incident lessons into durable detection and response capabilities across a global IT and manufacturing (OT) environment. The role aims to reduce manual effort, improve signal quality, and shorten time to detect and respond.

The position includes leading high-severity incident response; engineering and maintaining SIEM/EDR detections and log pipelines; building SOAR automations and AI-assisted SOC workflows; conducting threat hunts; maintaining SOC procedures and metrics; mentoring analysts; and participating in the senior on-call escalation rotation. The role reports to the Manager, Security Operations.

Requirements

• Bachelor’s degree in a related field such as Information Security or Computer Science, or equivalent professional experience.
• 6+ years of related experience, including 3+ years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent.
• Proven experience leading investigations and response for significant security incidents in an enterprise environment.
• Advanced proficiency with SIEM and EDR platforms, including authoring and tuning detections in KQL or a similar query language.
• Hands-on experience building SOAR playbooks and automations.
• Scripting proficiency in Python and/or PowerShell, plus REST API integration experience.
• Practical experience applying AI or LLM tools to security operations, with understanding of their risks and limitations.
• Strong working knowledge of Windows, Linux, and macOS internals; Active Directory and Entra ID; email security; network protocols; and Azure/M365 attack surfaces.
• Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.
• Clear written and verbal communication, including preparing incident reports for technical and executive audiences.
• Self-directed, with sound judgment under pressure and the ability to prioritize competing incidents and engineering work.

Nice To Haves

• Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.
• Experience with OT/ICS security monitoring in manufacturing environments.
• Experience with log pipeline tooling such as Cribl, detection-as-code, and Git-based workflows.
• Experience working with an MDR provider.
• Experience with Microsoft Sentinel and CrowdStrike NG-SIEM.

Responsibilities

• Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and the MDR provider, leading investigations through containment, eradication, and recovery.
• Lead technical response to high-severity incidents; coordinate with IT, infrastructure, OT, and business stakeholders; and produce executive and technical incident reports.
• Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.
• Design, build, test, and tune SIEM and EDR detections using KQL and related query languages; map coverage to MITRE ATT&CK and enterprise and OT threat scenarios.
• Own the detection lifecycle, including reducing false positives, analyzing coverage gaps, and applying detection-as-code practices with version control and peer review.
• Engineer log pipelines and data quality with Cribl to ensure telemetry is complete, normalized, and cost-effective.
• Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure, targeting reductions in analyst hours and mean time to respond.
• Design, test, and operationalize AI-assisted SOC workflows, applying guardrails such as least privilege, human approval for destructive actions, prompt-injection resilience, and output validation.
• Integrate security tools through APIs and Python and/or PowerShell scripting to reduce repetitive manual work.
• Conduct hypothesis-driven threat hunts informed by current threat intelligence and actor TTPs, and convert findings into new detections.
• Assess emerging vulnerabilities and threats for CommScope exposure and recommend prioritized response actions.
• Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises.
• Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer.
• Report SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved.
• Participate in the PagerDuty on-call rotation as the senior escalation tier.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior