Sr Detection and Response Engineer, Information Security

CommScope•Charlotte, NC

About The Position

CommScope is seeking a Senior Detection and Response Engineer to serve as the L3 technical lead and escalation point in its Security Operations Center. This hands-on engineering role owns complex investigations and incident response end to end and develops detections, automations, and AI-assisted workflows to help a lean team operate at scale. The engineer works closely with the MDR partner and junior analysts, turning incident lessons into durable detection and response capabilities across a global IT and manufacturing (OT) environment. The role aims to reduce manual effort, improve signal quality, and shorten time to detect and respond. The position leads high-severity incident response, performs forensic analysis, and builds and tunes SIEM and EDR detections. It also engineers telemetry pipelines, SOAR playbooks, API integrations, and guarded AI-assisted SOC workflows. Additional work includes threat hunting, maintaining SOC procedures and exercises, mentoring analysts, reporting effectiveness metrics, and participating in the senior-tier on-call rotation.

Requirements

At least 6 years of experience in information security, including at least 3 years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent.
Bachelor’s degree in a related field, such as Information Security or Computer Science, or equivalent professional experience.
Proven experience leading investigations and response for significant security incidents in an enterprise environment.
Advanced proficiency with SIEM and EDR platforms, including authoring and tuning detections in KQL or similar query languages.
Hands-on experience building SOAR playbooks and automations.
Scripting proficiency in Python and/or PowerShell, plus REST API integration experience.
Practical experience applying AI or LLM tools to security operations, such as triage, enrichment, summarization, or query generation, and understanding of their risks and limitations.
Strong working knowledge of Windows, Linux, and macOS internals; Active Directory and Entra ID; email security; network protocols; and Azure/M365 attack surfaces.
Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.
Clear written and verbal communication, including the ability to produce incident reports for technical and executive audiences.
Self-directed, with sound judgment under pressure and the ability to prioritize competing incidents and engineering work.

Nice To Haves

Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.
Experience with OT/ICS security monitoring in manufacturing environments.
Experience with log pipeline tooling such as Cribl, detection-as-code, and Git-based workflows.
Experience working with an MDR provider.
Preferred experience with Microsoft Sentinel and CrowdStrike NG-SIEM.

Responsibilities

Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and the MDR provider.
Lead investigations through containment, eradication, and recovery, and act as technical incident lead for high-severity events.
Coordinate with IT, infrastructure, OT, and business stakeholders; produce executive and technical incident reports.
Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.
Design, build, test, and tune SIEM and EDR detections using KQL and related query languages.
Map detection coverage to MITRE ATT&CK and CommScope’s enterprise and OT threat scenarios.
Own the detection lifecycle, including false-positive reduction, coverage gap analysis, and detection-as-code practices with version control and peer review.
Engineer log pipelines and data quality with Cribl to ensure telemetry is complete, normalized, and cost-effective.
Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure.
Design, test, and operationalize AI-assisted SOC workflows, with appropriate guardrails including least privilege, human approval for destructive actions, prompt-injection resilience, and output validation.
Integrate security tooling through APIs and scripting to eliminate manual and repetitive work.
Conduct hypothesis-driven threat hunts informed by threat intelligence and actor TTPs, and convert findings into detections.
Assess emerging vulnerabilities and threats for CommScope exposure and recommend prioritized response actions.
Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises.
Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer.
Report SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved.
Participate in the PagerDuty on-call rotation as the senior escalation tier.