Detection and Response Engineer

This is a fully remote position, open to applicants in California.

📋 Description

• Identify, investigate, and respond to security incidents within cloud, corporate, and production environments as an active member of the TDIR team.

• Observe and analyze security telemetry and audit logs to detect unusual activities, unauthorized access, emerging threats, targeted attacks, and advanced adversaries.

• Conduct alert triage, detailed investigations, and forensic analyses through containment, remediation, and post-incident reviews.

• Carry out investigations involving endpoints, identities, cloud environments, and malware, which includes timeline reconstruction, indicator extraction, and root cause analysis.

• Create, enhance, and fine-tune SIEM threat detections based on attacker behaviors and findings from investigations.

• Enhance investigation and response effectiveness through automation, SOAR workflows, scripting, and advanced analytics.

• Design, construct, or manage AI/LLM-assisted triage and enrichment workflows.

• Assess and strengthen AI-assisted security tools against adversarial inputs, including risks related to prompt injection and verdict-poisoning.

• Contribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics.

• Work collaboratively with engineering teams, business stakeholders, and vendors during investigations and response activities.

• Participate in an on-call rotation and offer off-hours support for critical incidents and significant security events.

• Deliver investigation findings to technical teams and leadership.

• Travel occasionally, up to approximately 10%, to assist studios or engage in on-site incident response.

⛳️ Requirements

• Bachelor’s degree in computer science, Information Security, or a comparable practical experience.

• Over 10 years of progressively responsible security experience.

• Practical experience in threat detection, security operations, and incident response throughout the entire incident lifecycle.

• In-depth understanding of the current threat landscape, including attacker tactics, techniques, and procedures.

• Demonstrated ability to detect, triage, investigate, and respond to security incidents in enterprise settings.

• Experience with comprehensive log analysis, correlation, and investigative triage.

• Excellent written and verbal communication skills.

• Capability to work independently as well as collaboratively with technical and business stakeholders.

• Willingness to participate in an on-call rotation and provide off-hours support.

• Practical experience with SIEM and EDR platforms, including the development or significant enhancement of detection content.

• Proficiency in scripting or programming languages such as Python, PowerShell, or KQL.

• Strong skills in host- and network-based forensics, including timeline reconstruction and root cause analysis.

• Familiarity with LLM applications in security operations and associated failure modes.

• Proficiency in English.

• Preferred: More than 12 years of relevant IT and security experience, leadership or mentorship experience, malware analysis, SOAR, AI-assisted triage, identity-focused detection, security hardening, leadership/vendor interfacing, and engagement with the cybersecurity community.

🏝️ Benefits

• Medical, dental, vision, health savings account or health reimbursement account, healthcare spending accounts, dependent care spending accounts, life and AD&D insurance, disability insurance.

• 401(k) with Company match.

• Tuition reimbursement.

• Charitable donation matching.

• Paid holidays and vacation.

• Paid sick time.

• Floating holidays.

• Compassion and bereavement leaves.

• Parental leave.

• Mental health & wellbeing programs.

• Fitness programs.

• Free and discounted games.

• Voluntary benefit programs including supplemental life & disability, legal service, ID protection, and rental insurance.

• Relocation assistance may be available if the Company necessitates geographic relocation.

• Incentive compensation may be available; however, it is not guaranteed.