Sr. Threat Detection and Incident Response Engineer

Motorola Solutions•Illinois, US Offsite, MA

1d•$110,000 - $130,000

About The Position

Motorola Solutions is seeking a Senior Security Threat Detection and Incident Response Engineer to advance proactive threat management and automated response capabilities. The role focuses on integrating intelligent workflows and AI-driven playbooks into global security operations to help teams observe, analyze, and mitigate cyber incidents in real time. It spans threat research, cloud defense engineering, and operational response, with collaboration across Architecture, Cloud Security, SOC, Security Engineering, and technical operations teams. The work supports protection of mission-critical systems and public safety infrastructure across multi-cloud and enterprise environments. The position includes building and maintaining threat management, detection, and incident response platforms; developing automated response workflows; investigating high-severity alerts and active incidents; and conducting purple team exercises and post-incident analysis. The engineer also helps align enterprise platforms and detection tools with security control baselines, compliance standards, and NIST 800-53 governance frameworks. The role participates in an on-call rotation and requires U.S. citizenship and the ability to obtain required background clearance. Work in high-security areas requires passing a more stringent fingerprint background check under the U.S. Department of Justice CJIS Security Policy. The stated target base salary range is $110,000–$130,000 USD. Travel is under 10%, and relocation is not provided.

Requirements

Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, with 5+ years of experience in information security, threat detection, or incident response; alternatively, 8+ years of equivalent experience may substitute for a bachelor's degree.
5+ years of experience in Cloud Security, Scripting & Automation, SOAR & API Integration, Cloud Detection Technologies, and Telemetry & Log Architecture.
Must be a U.S. citizen.
Must be able to obtain background clearance as required by the government customer.
Experience securing and monitoring multi-cloud infrastructure such as AWS, Azure, or GCP.
Proficiency in Python or another modern programming language for building integrations and automated workflows.
Direct experience with REST APIs, webhooks, and orchestration tools for automating response playbooks.
Strong operational proficiency with Linux/UNIX environments, CLI tooling, and system-level logging.
Experience with CNAPP or Cloud Detection and Response (CDR) solutions.
In-depth familiarity with endpoint EDR/XDR telemetry, network flow, identity/IAM logs, and centralized SIEM or data-lake querying.
Ability to communicate technical security risks and findings to diverse stakeholders, including developers, product management, and legal partners.
Track record acting as an incident responder or escalation point during active operational security events.
Background supporting security compliance reviews and aligning threat management practices with regulatory standards.
Must successfully pass the required stringent fingerprint background check for work in high-security areas governed by the CJIS Security Policy.

Nice To Haves

Experience utilizing agentic AI agents, LLMs, or assisted intelligence frameworks in security operations.
Hands-on experience with purple teaming and adversarial simulation frameworks such as Caldera or Stratus Red Team.
Familiarity with digital forensics fundamentals, including memory/disk triage, live response scripting, and timeline creation.
Familiarity with modern web-based application design, API security, and application security principles.
Familiarity with cloud-native containerized architectures and orchestration platforms such as Kubernetes.
Professional industry certifications such as CISSP, GCIA, GCIH, or cloud security credentials.

Responsibilities

Build and maintain scalable threat management, detection, and incident response platforms across multi-cloud environments.
Design and implement automated workflows and playbooks using AI-assisted actions to streamline triage and mitigation.
Observe, oversee, and analyze system telemetry to identify threat detection gaps and deploy high-fidelity detection logic.
Serve as an escalation point for high-severity security alerts and participate in an on-call rotation to investigate and remediate active security incidents.
Partner with SOC and Incident Response peers to conduct structured purple team exercises that validate detection efficacy and incident readiness.
Drive post-incident reviews and root-cause analyses and feed actionable improvements into detection pipelines.
Partner with Architecture and Security Engineering teams to help ensure secure implementation of enterprise platforms and detection tools.
Support technical adherence to security control baselines, compliance standards, and NIST 800-53 governance frameworks.
Collaborate across engineering and technical operations to deliver measurable security resilience across the technology stack.