> Markdown version of [/jobs/ext/4608888-sr-threat-detection-and-incident-response-engineer](https://www.wearedevelopers.com/jobs/ext/4608888-sr-threat-detection-and-incident-response-engineer). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Sr. Threat Detection and Incident Response Engineer - **Company:** Motorola Solutions, Inc. - **Location:** United States - **Experience:** Expert - **Salary:** $110,000 - $130,000 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cloud Engineering, Cyber Security, Digital Forensics, Identity and Access Management, Intrusion Detection and Prevention, Python (Programming Language), Azure Active Directory, Red Team (Cyber Security), Security Information and Event Management, Web Applications, Workflow Management Systems, Datadog, Data Logging, Okta, Large Language Models, Snowflake, Software Security, Multi-Cloud, Cyber Threat Analysis, Kubernetes, Information Technology, Microsoft Sentinel, Purple Team (Cyber Security), Restful APIs, Splunk, Webhooks, SentinelOne Expertise, Security Orchestration, Automation & Response, Programming Languages - **Published:** November 6, 2026 - **Apply:** https://motorolasolutions.wd5.myworkdayjobs.com/Careers/job/Illinois-US-Offsite/Sr-Threat-Detection-and-Incident-Response-Engineer_R70189 ## About the Role * Bachelor's degree in Computer Science, Cybersecurity, or Information Technology - preferred * 5+ years of experience in information security, threat detection, or incident response * Must be a U.S. citizen with the ability to obtain necessary security clearance as required by government contract Technical Expertise : * Cloud Security: Experience securing and monitoring multi-cloud infrastructure (AWS, Azure, or GCP) * Scripting & Automation: Proficient in Python or another modern programming language to build integrations and automated workflows * SOAR & API Integration: Direct experience leveraging REST APIs, webhooks, and orchestration tools to automate response playbooks * Linux/UNIX Systems: Strong operational proficiency with Linux/UNIX environments, CLI tooling, and system-level logging * Cloud Detection Technologies: Experience working with Cloud-Native Application Protection Platforms (CNAPP) or Cloud Detection and Response (CDR) solutions * Telemetry & Log Architecture: In-depth familiarity with endpoint (EDR/XDR telemetry like Sysmon, CrowdStrike, SentinelOne), network flow, identity/IAM logs (Okta, Azure AD/Entra ID, AWS CloudTrail), and centralized SIEM/data-lake querying (e.g., Snowflake, Splunk, Microsoft Sentinel, Datadog). Professional Experience: * Collaborative Communication: Demonstrated ability to communicate technical security risks and findings to diverse stakeholders including developers, product management, and legal partners * Incident Escalation: Proven track record acting as an incident responder or escalation point during active operational security events * Compliance Mindset: Background supporting security compliance reviews and aligning threat management practices with regulatory standards, * Experience utilizing agentic AI agents, LLMs, or assisted intelligence frameworks in security operations * Hands-on experience with purple teaming and adversarial simulation frameworks such as Caldera or Stratus Red Team * Familiarity with digital forensics fundamentals (memory/disk triage, live response scripting, timeline creation). * Familiarity with modern web-based application design, API security, and application security principles * Familiarity with cloud-native containerized architectures and orchestration platforms such as Kubernetes * Professional industry certifications such as CISSP, GCIA, GCIH, or cloud security credentials, Bachelor's degree in Computer Science, Cybersecurity, or Information Technology or a related field with 5+ years of experience in information security, threat detection, or incident response (OR) 8+ years equivalent experience in lieu of a Bachelor's degree. 5+ years experience in Cloud Security, Scripting & Automation, SOAR & API Integration, Cloud Detection Technologies, Telemetry & Log Architecture. Must be a U.S. citizen. Must be able to obtain background clearance as required by government customer ## Description We are seeking a Senior Security Threat Detection and Incident Response Engineer to advance our proactive threat management capabilities and automated response posture. In this role, you will champion the integration of intelligent workflows and AI-driven playbooks to elevate how our global security operations observe, analyze, and mitigate cyber incidents in real time. You will work at the intersection of threat research, cloud defense engineering, and operational response, partnering closely with Architecture, Cloud Security, and SOC teams to help ensure our defenses are robust and resilient. Whether designing autonomous remediation logic, investigating complex incidents, or running collaborative purple team simulations, your contributions will protect critical environments where reliability is essential. A Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or equivalent practical experience will set you up for success in this role., Threat Detection Engineering & Automation : * Build and maintain scalable threat management, detection, and incident response platforms across multi-cloud environments * Design and implement automated workflows and playbooks leveraging AI-assisted actions to streamline triage and mitigation * Observe, oversee, and analyze system telemetry to identify threat detection gaps and deploy robust, high-fidelity detection logic Incident Response Operations & Purple Teaming * Serve as an escalation point for high-severity security alerts and participate in an on-call rotation to investigate and remediate active security incidents * Partner with SOC and Incident Response peers to conduct structured purple team exercises that validate detection efficacy and incident readiness * Drive post-incident reviews and root-cause analyses to feed actionable improvements directly back into detection pipelines Architecture Alignment & Governance * Partner with Architecture and Security Engineering teams to help ensure secure implementation of enterprise platforms and detection tools * Support technical adherence to relevant security control baselines, compliance standards, and NIST 800 53 governance frameworks * Collaborate cross-functionally across engineering and technical operations to help deliver measurable security resilience across our technology stack