Sr Specialist – Cybersecurity Operations; Detection and Response

Merk•Rahway, NJ

1d•Remote

About The Position

The Sr Specialist – Cybersecurity Operations; Detection and Response is an experienced incident response analyst who designs, develops, and enhances threat detection capabilities across enterprise detection platforms. The role focuses on creating and optimizing threat detection use cases, identifying and mitigating threats in real time, supporting critical incident response, and mentoring junior analysts. It collaborates with cross-functional teams to align detection solutions with the organization’s security strategy. This is a remote position; remote work approval is also noted as subject to consideration for the right candidate. The specialist develops high-fidelity detection use cases, correlation rules, and detection models tailored to the organization’s risk profile and threat landscape. The role investigates critical incidents, coordinates containment and recovery activities, automates response workflows, conducts forensic analysis, communicates actionable recommendations, and improves the team’s processes and capabilities.

Requirements

Bachelor’s degree in Cybersecurity, Computer Science, Information Technology, or a related field.
At least 5 years of experience in IR operations, intrusion detection, threat hunting, or incident response.
Experience developing detection rules, playbooks, and automation workflows.
Demonstrated experience leading complex investigations and coordinating cross-functional response efforts.
Expert understanding of attack lifecycles, network telemetry, endpoint data, and adversarial tactics mapped to MITRE ATT&CK.
Ability to design and optimize automated response workflows in SOAR tools.
Experience with SIEM platforms such as Microsoft Sentinel and Google SecOps for event correlation and detection engineering.
Strong knowledge of SIEM/SOAR technologies for orchestration and response automation.
Familiarity with EDR tools such as Microsoft Defender for Endpoint, CrowdStrike, and Sysinternals.
Understanding of the NIST Incident Response Framework, MITRE ATT&CK, and ISO 27001.
Experience with Python and PowerShell.
Strong knowledge of Windows Active Directory environments and cloud computing architectures.
Experience conducting forensic analysis, log correlation, and root-cause investigations.
Strong communication skills for conveying findings to technical and non-technical audiences.
Ability to work collaboratively across teams and foster an environment where team members thrive.
Ability to model ethical conduct, transparency, and accountability and ensure compliance with cybersecurity and data privacy standards.
Curiosity, adaptability, and a growth mindset, with an interest in encouraging innovation, learning, and continuous improvement.

Nice To Haves

Advanced certifications such as GIAC GCIH or GCFA.
At least 5 years of experience in detection engineering roles for large organizations.
Hands-on experience with cloud-native security tooling and hybrid SOC environments.

Responsibilities

Design and implement advanced detection use cases across SIEM, EDR, XDR, and cloud security platforms.
Develop and refine high-fidelity detection use cases, custom correlation rules, and detection models tailored to the organization’s risk profile and threat landscape.
Continuously optimize detection techniques to reduce alert fatigue and improve detection efficacy.
Identify and implement improvement initiatives, best practices, and process optimizations within the Detection and Response team.
Investigate critical incidents and coordinate containment activities with response teams and IT stakeholders.
Document lessons learned and controls implementation through after-action reports.
Use SOAR platforms to automate triage, enrichment, and response workflows.
Conduct forensic analysis and validate root causes using endpoint protection and diagnostic tools, including Microsoft Defender for Endpoint and CrowdStrike.
Work with internal stakeholders, leadership, and external partners to provide situational awareness and actionable recommendations.
Coach and mentor junior analysts through technical guidance, knowledge sharing, and training.
Lead incident response through the full lifecycle, from identification through post-incident recovery.
Evaluate emerging threats and incorporate new tactics into the detection engineering pipeline.
Perform log analysis on large data sets and correlate unique identifiers across technologies.
Use AI and machine learning tools in investigative processes to improve detection accuracy and reduce false positives.
Align response actions with business impact and operational risk.