Cybersecurity Engineer III, Detection and Response at Upbound Group in Plano, TX

Job description

Job Description: Cybersecurity Engineer III, Detection and Response Job Purpose: The Cybersecurity Engineer III, Detection and Response strengthens Upbound's Security Operations capabilities through detection engineering, AI-assisted security operations, incident response, threat hunting, and security telemetry engineering. This senior technical contributor will build, test, and maintain reliable security monitoring capabilities across cloud, identity, endpoint, network, SaaS, and AI-enabled environments. The engineer will use modern AI technologies as part of daily security operations, applying appropriate validation, data protection safeguards, and human oversight to improve investigative speed and effectiveness. The position partners with application, infrastructure, cloud, engineering, and product teams to establish security logging requirements, implement reliable ingestion pipelines, develop actionable detections, and assess operational security requirements for new projects and products. Key Responsibilities: Design, develop, test, and tune security detections as code, mapping use cases to MITRE ATT&CK and validating effectiveness through adversary emulation, offensive testing, or controlled simulations. Build and operate AI-assisted security workflows, including investigation agents, automated triage, detection development, and response playbooks, with human decision points, accuracy checks, and appropriate data protection safeguards. Conduct proactive threat hunting across identity, endpoint, network, cloud, and SaaS environments, using threat intelligence and attacker techniques to identify suspicious activity and detection gaps. Independently investigate complex security incidents, including identity-based attacks, and coordinate technical containment, root cause analysis, remediation, and post-incident reviews. Engineer and maintain reliable SIEM logging pipelines across cloud, identity, endpoint, network, SaaS, and AI-enabled environments, including ingestion, parsing, normalization, integration troubleshooting, telemetry quality, and logging requirements for new projects and products. Validate critical and known-exploited vulnerabilities using assessment results, exploitability information, and system evidence; coordinate remediation verification and implement compensating detections while fixes are underway. Partner with application, infrastructure, cloud, product, and managed security teams to assess security monitoring requirements, improve detection quality, operationalize security capabilities, and support technical security reviews. Develop security automation, maintain technical documentation and runbooks, and contribute to operational metrics covering detection and containment times, priority detection coverage, automation accuracy, and exploitable exposure age. Required Qualifications: Five or more years of relevant experience spanning security operations, detection engineering, and incident response, with the ability to independently handle complex investigations and develop security detections. Equivalent demonstrated capability will be considered. Hands-on experience with modern SIEM and XDR platforms, including detection development, correlation logic, security query languages, and techniques for testing and tuning detections. Practical experience conducting threat hunts and investigating security activity across identity, endpoint, cloud, and SaaS environments, including Microsoft Entra ID, Microsoft 365, AWS, and Azure. Demonstrated experience using modern AI technologies for security investigations, detection engineering, or automation, including the ability to validate AI-generated outputs and recognize their limitations. Proficiency with Python, APIs, and security telemetry integrations, including log ingestion, parsing, normalization, and troubleshooting. Working knowledge of vulnerability assessment and exploitability validation, with strong analytical, technical documentation, and communicati