Security Incident Response & Detection Engineer IV

• Administer and enhance the ServiceNow Security Incident Response (SIR) module: security incident workflows, assignment and escalation rules, SLA definitions, form and UI configuration, and integrations with SIEM, SOAR, and threat intelligence sources.
• Design, build, and maintain the Detection-as-Code (DaC) pipeline: detection development, version control, CI/CD-based testing, and automated deployment.
• Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
• Build SOAR playbooks, API integrations, and automation to streamline SOC workflows.
• Support administration and optimization of the SIEM/SOAR platform stack.
• Contribute to AI SOC initiatives: investigation coverage expansion, alert triage automation, and integration health.
• Apply MITRE Telecommunication & CK mapping, FP-rate gating*** and detection lifecycle standards to all deployed content.
• Partner with SOC analysts and incident response to translate operational gaps into engineering solutions.

• Proven SOC experience (detection engineering, security engineering, or senior analyst capacity) with a demonstrable engineering mindset.
• Hands-on experience administering the ServiceNow Security Incident Response (SIR) module: configuring security incident workflows, business rules, assignment logic, and SIEM/SOAR/API integrations, and maintaining the module in a production SOC environment.
• Hands-on automation and scripting, primarily Python, and experience building or contributing to Detection-as-Code pipelines.
• Strong grounding in MITRE Telecommunication & CK, Pyramid of Pain, Cyber Kill Chain, and the incident response process and its phases.
• Deep understanding of at least one of: endpoint security (macOS and Windows internals, telemetry, detection) or cloud infrastructure (cloud-native services, Kubernetes, runtime detection).
• Solid networking fundamentals, including DNS.
• Working knowledge of IAM, SSO (SAML/OIDC), and Zero Trust architecture concepts.
• Working knowledge of Data Loss Prevention concepts and detection use cases.
• Understanding of AI Detection & Response: securing and monitoring AI/LLM usage in the enterprise.
• Familiarity with agentic AI frameworks and applying AI to SOC operations and detection engineering workflows.

Preferred:

• ServiceNow certifications relevant to the platform (e.g., Certified System Administrator, Security Incident Response implementation experience).
• CI/CD tooling (Git, GitHub Actions or similar) for security content deployment.
• Experience integrating AI/LLM capabilities into SOC triage or detection pipelines.
• Familiarity with Risk-Based Alerting concepts.

Education Required Bachelor’s degree in an IT-related or Engineering field.

Education Preferred Bachelor’s degree in an IT-related or Engineering field.