Security Operations Engineer II

Credit Acceptance

. Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services .

Posted 10/23/2026full-timeUnited StatesJuniorMid-Level💰 $101,605 - $142,247 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in Cyber Defense operations, including incident response, security platform management, and automation practices. Proficient in developing detection logic and maintaining enterprise security resources using Infrastructure as Code and scripting.

Highest-signal resume keywords

Cybersecurity EngineeringIncident ResponseSIEM ManagementEndpoint Detection And ResponseInfrastructure As Code

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

CybersecurityIncident ResponseSIEMEDRScriptingAPIsVersion ControlCloud SecurityDetection EngineeringTechnical Documentation

Soft Skills

TroubleshootingClear CommunicationKnowledge Sharing

Tools & Technologies

Automation ToolsWebhooksTelemetrySecure Web AccessAI-Assisted Workflows

Certifications & Qualifications

Cybersecurity CertificationsSecurity Operations CertificationsCloud Fundamentals Certifications

Industry Keywords

Cyber DefenseSecurity OperationsIncident Response FrameworksCloud EnvironmentsAccess Controls

Tech Stack

Tools & technologies

CloudCyber Security

About the role

Key responsibilities & impact

Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services
Maintain next-generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, or data-quality issues
Maintain endpoint detection and response capabilities; support investigations and approved containment actions
Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues
Support web application protections with network and application teams; implement rules, logging, integrations, and approved exceptions
Perform initial triage of cybersecurity alerts and incidents; gather evidence, document findings, determine scope, and escalate as needed
Support approved containment, remediation, and recovery actions across enterprise and cloud environments
Develop and tune detection logic to improve signal quality and investigative value
Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks
Use Infrastructure as Code, version control, testing, and change-management practices to maintain approved Cyber Defense resources
Use AI-assisted workflows to improve analysis and efficiency while applying access controls, testing, human oversight, and audit requirements
Monitor platform health; maintain technical documentation; share knowledge; and participate in security projects and the on-call rotation
Participate in on-call rotations, including nights, weekends, and holidays
Perform all other duties as assigned

Requirements

What you’ll need

Bachelor’s degree in computer science, Information Systems, Cybersecurity, or a related field, or equivalent practical experience
Minimum 2 years of experience in cybersecurity engineering, security operations, incident response, or a related technical field
Experience triaging cybersecurity alerts or incidents and supporting approved containment actions
Hands-on experience supporting enterprise security platforms in at least two areas such as SIEM, EDR, secure web access, WAF, automation, or detection engineering
Experience using a scripting or automation language and working with APIs, webhooks, or structured configuration files
Experience with version control and Infrastructure as Code concepts
Working knowledge of cloud services and cloud security logs
Understanding of secure authentication, credential handling, and least-privilege access
Knowledge of incident response, common attacker techniques, and established cybersecurity frameworks
Ability to troubleshoot across multiple technologies and produce clear technical documentation
Candidates must reside in or be willing to relocate to the greater Southfield, Michigan, area; greater Bellevue, Washington, area; or San Francisco Bay Area, California
Required degrees must have been earned at accredited institutions of higher education or equivalent
Preferred: experience investigating incidents in public cloud environments and using cloud logs
Preferred: experience with security orchestration, incident-response automation, telemetry onboarding, or detection engineering
Preferred: experience with secure web access or web application protection
Preferred: experience creating reusable Infrastructure as Code modules
Preferred: experience using AI-assisted development, agent-based workflows, or containerized automation
Preferred: relevant cybersecurity, security operations, cloud fundamentals, or automation certifications

Benefits

Comp & perks

401(K) match
Adoption assistance
Parental leave
Tuition reimbursement
Comprehensive medical, dental, and vision coverage
Many nonstandard benefits
Annual variable cash incentive between 7.5% and 15%