Detection and Response Engineer

XBOX

. Detect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands-on TDIR team member .

Posted 10/14/2026full-timeRemote • California • United StatesSeniorLead💰 $124,000 - $229,400 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates extensive experience in threat detection, incident response, and security operations, with a strong focus on automation and advanced analytics. Proficient in forensic analysis, SIEM, and EDR platforms, with the ability to communicate findings effectively to both technical teams and leadership.

Highest-signal resume keywords

Threat DetectionIncident ResponseSIEM PlatformsForensic AnalysisScripting Experience

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Threat DetectionIncident ResponseForensic AnalysisLog AnalysisRoot Cause AnalysisAutomationSIEMEDRScriptingMalware Analysis

Soft Skills

Strong Communication SkillsCollaborative WorkIndependent Work

Tools & Technologies

SIEM PlatformsEDR PlatformsSOAR WorkflowsAI/LLM Applications

Industry Keywords

CybersecurityIncident LifecycleThreat LandscapeAdversarial InputSecurity Hardening

Tech Stack

Tools & technologies

CloudCyber SecurityPython

About the role

Key responsibilities & impact

Detect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands-on TDIR team member
Monitor and analyze security telemetry and audit logs to identify anomalous activity, unauthorized access, emerging threats, targeted attacks, and advanced adversaries
Perform alert triage, in-depth investigation, and forensic analysis through containment, remediation, and post-incident review
Execute endpoint, identity, cloud, and malware investigations, including timeline reconstruction, indicator extraction, and root cause analysis
Develop, refine, and tune SIEM threat detections based on attacker behavior and investigation findings
Improve investigation and response efficiency through automation, SOAR workflows, scripting, and advanced analytics
Design, build, or operate AI/LLM-assisted triage and enrichment workflows
Evaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict-poisoning risks
Contribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics
Collaborate with engineering teams, business stakeholders, and vendors during investigations and response efforts
Participate in an on-call rotation and provide off-hours support for critical incidents and material security events
Communicate investigation findings to technical teams and leadership
Travel occasionally, up to approximately 10%, to support studios or on-site incident response

Requirements

What you’ll need

Bachelor’s degree in computer science, Information Security, or equivalent practical experience
10+ years of progressively accountable security experience
Hands-on experience in threat detection, security operations, and incident response across the full incident lifecycle
Strong understanding of the modern threat landscape, attacker tactics, techniques, and procedures
Proven ability to detect, triage, investigate, and respond to security incidents in enterprise environments
Experience with detailed log analysis, correlation, and investigative triage
Strong written and verbal communication skills
Ability to work independently and collaboratively with technical and business stakeholders
Willingness to participate in an on-call rotation and provide off-hours support
Hands-on experience with SIEM and EDR platforms, including building or significantly extending detection content
Scripting or programming experience such as Python, PowerShell, or KQL
Strong host- and network-based forensic skills, including timeline reconstruction and root cause analysis
Working knowledge of LLM applications in security operations and related failure modes
Fluency in English
Preferred: 12+ years of relevant IT and security experience, leadership or mentorship experience, malware analysis, SOAR, AI-assisted triage, identity-focused detection, security hardening, leadership/vendor interfacing, and cybersecurity community engagement

Benefits

Comp & perks

Medical, dental, vision, health savings account or health reimbursement account, healthcare spending accounts, dependent care spending accounts, life and AD&D insurance, disability insurance
401(k) with Company match
Tuition reimbursement
Charitable donation matching
Paid holidays and vacation
Paid sick time
Floating holidays
Compassion and bereavement leaves
Parental leave
Mental health & wellbeing programs
Fitness programs
Free and discounted games
Voluntary benefit programs including supplemental life & disability, legal service, ID protection, and rental insurance
Relocation assistance may be available if the Company requires geographic relocation
Incentive compensation may be available; not guaranteed