Sr. Security Engineer

Sinclair Broadcast Group•Cockeysville, MD

5h•$111,000 - $147,805

About The Position

Sinclair is seeking an experienced, technically driven security professional to advance its Information Security program. The Senior Security Engineer focuses on Security Operations, incident response, and advanced detection engineering. The role independently investigates complex threats; engineers high-fidelity detections across endpoint, identity, network, and cloud environments; and strengthens incident response through security tooling, workflow orchestration, and automation. It also evaluates and applies AI-assisted capabilities where they can improve investigation quality and response efficiency. The engineer partners with internal teams, business stakeholders, and external security providers to improve detection coverage, accelerate response, and reduce enterprise risk. The role leads complex incident investigations and response, develops and validates detections, and designs automated SecOps workflows. It measures operational effectiveness, documents procedures and safeguards, identifies automation opportunities while preserving human oversight, and mentors engineers and analysts. The position requires a bachelor’s degree or equivalent professional experience and at least five years of relevant hands-on experience, including ownership of complex investigations. It also requires at least three years of experience with Microsoft Defender and related Microsoft security and identity technologies, and at least three years with enterprise security technologies such as Zscaler, CrowdStrike Falcon, Abnormal Security, Tines, Armis, and Splunk or equivalent platforms. Visa sponsorship is not available. The base salary range is $111,000 to $147,805. Full-time positions are eligible for benefits.

Requirements

Bachelor’s degree in cybersecurity, computer science, information technology, or equivalent professional experience.
At least 5 years of hands-on experience in security operations, incident response, threat detection, security engineering, or a closely related discipline, including ownership of complex investigations.
Demonstrated experience building and tuning advanced detections in a SIEM, EDR/XDR, or cloud security analytics platform, with the ability to explain detection logic and validate evidence.
Strong understanding of attacker techniques, Windows and Linux internals, identity-based attacks, network protocols, cloud security, and incident response methodology.
Hands-on experience integrating security platforms through APIs, developing orchestration workflows, and implementing automated investigation or response actions using SOAR tools and enterprise IT service-management platforms.
At least 3 years of hands-on experience with the Microsoft Defender security suite and related Microsoft security and identity technologies, including Entra ID.
At least 3 years of hands-on experience with enterprise security technologies such as Zscaler, CrowdStrike Falcon, Abnormal Security, Tines, Armis, and Splunk, or equivalent platforms; strong experience across multiple tools is expected, but not every named product is required.
Ability to investigate incidents and engineer or tune detections directly in EDR/XDR, SIEM, network security, email security, and identity platforms, including querying telemetry, investigating alerts, and operationalizing response actions.
Knowledge of MITRE ATT&CK, NIST incident-response guidance, and security engineering best practices.
Excellent written and verbal communication, cross-functional collaboration, and demonstrated ownership of technical initiatives.

Nice To Haves

Familiarity with AI-assisted security investigation, agent-based automation, or LLM-enabled security workflows; specialized AI development or production AI-agent experience is not required.
Professional security certifications such as CISSP, GCIH, GCFA, GCDA, or equivalent.

Responsibilities

Lead technical investigation, triage, containment, eradication, and recovery for complex incidents across on-premises, cloud, identity, and endpoint environments.
Analyze security telemetry, authentication activity, process execution, network traffic, and threat intelligence to determine root cause, scope, impact, and response.
Conduct proactive threat hunting and retrospective investigations, identifying gaps in telemetry, detection, and response capabilities.
Own high-severity investigations, document evidence-based findings, communicate business impact, and coordinate remediation with system owners and external partners.
Apply MITRE ATT&CK and other threat-informed methodologies to improve investigation quality, detection coverage, and response effectiveness.
Design, develop, test, deploy, and tune detections for multi-stage attacks and advanced adversary behaviors.
Correlate endpoint, SIEM, identity, email, network, and cloud telemetry to create behavioral, contextual, and risk-based detections.
Develop and maintain detection-as-code content, queries, analytics, and validation tests; assess false positives, data quality, precision, and coverage gaps.
Design, implement, and maintain automated SecOps and incident-response workflows using security platforms, APIs, SOAR technologies, and enterprise ticketing systems.
Integrate AI-assisted analysis and agent-based capabilities into investigation and response processes where appropriate.
Apply security controls to automated response workflows, including least-privilege access, action validation, approval for high-impact remediation, logging, exception handling, and analyst escalation.
Integrate third-party alert and investigation outputs with internal telemetry for independent validation and consistent remediation.
Collaborate with infrastructure, IAM, cloud, endpoint, IT operations, and external security partners to validate detections, remediate threats, and operationalize capabilities.
Measure and improve detection coverage and fidelity, mean time to detect and respond, investigation quality, automation success, and analyst effort saved.
Test detections and response workflows through attack simulations, adversary emulation, lessons learned, and controlled validation.
Document engineering designs, investigation procedures, response decision criteria, automation safeguards, and operational runbooks.
Identify repetitive analyst tasks for automation while preserving human oversight for uncertain, destructive, or business-disruptive actions.
Mentor engineers and analysts through technical reviews, investigation feedback, and knowledge sharing; promote sustainable engineering standards.
Evaluate security detection and response technologies, including AI-assisted capabilities, based on operational value, reliability, security, and measurable risk reduction.