> Markdown version of [/jobs/ext/4267091-security-incident-response-detection-engineer-iv](https://www.wearedevelopers.com/jobs/ext/4267091-security-incident-response-detection-engineer-iv). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Incident Response & Detection Engineer IV

- **Company:** Russell Tobin
- **Location:** Frisco, TX, United States
- **Salary:** $166,400.0 - $176,800.0
- **Contract:** Temporary to permanent
- **Skills:** Microsoft Windows, Artificial Intelligence, Apple Mac Systems, Cloud Computing, Continuous Integration, Information Leak Prevention, Domain Name System (DNS), Github, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Networking Basics, OpenID, Zero Trust Network Access, Security Assertion Markup Language (SAML), Security Information and Event Management, Large Language Models, Mitre Att&ck, Agentic-AI, Git, Kubernetes, Deployment Automation, Pyramid, Software Version Control, Api Management, Serverless Computing, Servicenow
- **Published:** October 6, 2026
- **Apply:** https://www.dice.com/job-detail/e0c48887-b09a-41c1-a333-8709eef8d9cd

## About the Role

* Proven SOC experience (detection engineering, security engineering, or senior analyst capacity) with a demonstrable engineering mindset.
 * Hands-on experience administering the ServiceNow Security Incident Response (SIR) module: configuring security incident workflows, business rules, assignment logic, and SIEM/SOAR/API integrations, and maintaining the module in a production SOC environment.
 * Hands-on automation and scripting, primarily Python, and experience building or contributing to Detection-as-Code pipelines.
 * Strong grounding in MITRE Telecommunication & CK, Pyramid of Pain, Cyber Kill Chain, and the incident response process and its phases.
 * Deep understanding of at least one of: endpoint security (macOS and Windows internals, telemetry, detection) or cloud infrastructure (cloud-native services, Kubernetes, runtime detection).
 * Solid networking fundamentals, including DNS.
 * Working knowledge of IAM, SSO (SAML/OIDC), and Zero Trust architecture concepts.
 * Working knowledge of Data Loss Prevention concepts and detection use cases.
 * Understanding of AI Detection & Response: securing and monitoring AI/LLM usage in the enterprise.
 * Familiarity with agentic AI frameworks and applying AI to SOC operations and detection engineering workflows.

Preferred:

 * ServiceNow certifications relevant to the platform (e.g., Certified System Administrator, Security Incident Response implementation experience).
 * CI/CD tooling (Git, GitHub Actions or similar) for security content deployment.
 * Experience integrating AI/LLM capabilities into SOC triage or detection pipelines.
 * Familiarity with Risk-Based Alerting concepts.

Education Required
Bachelor's degree in an IT-related or Engineering field.

Education Preferred
Bachelor's degree in an IT-related or Engineering field.

## Description

* Administer and enhance the ServiceNow Security Incident Response (SIR) module: security incident workflows, assignment and escalation rules, SLA definitions, form and UI configuration, and integrations with SIEM, SOAR, and threat intelligence sources.
 * Design, build, and maintain the Detection-as-Code (DaC) pipeline: detection development, version control, CI/CD-based testing, and automated deployment.
 * Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
 * Build SOAR playbooks, API integrations, and automation to streamline SOC workflows.
 * Support administration and optimization of the SIEM/SOAR platform stack.
 * Contribute to AI SOC initiatives: investigation coverage expansion, alert triage automation, and integration health.
 * Apply MITRE Telecommunication & CK mapping, FP-rate gating*** and detection lifecycle standards to all deployed content.
 * Partner with SOC analysts and incident response to translate operational gaps into engineering solutions.