Senior Detection & Response Engineer

Responsibilities

• Design build test and tune detection rules across our SIEM and security tooling targeting real attack techniquesobservedin our environment

• Build scripts automation and API integrations (using code and AI tooling) to accelerate detection engineering investigation and response workflows

• Lead incident response investigations end to end from triage through containment eradication and closure

• Perform host and cloud forensic analysis including disk memory and log artifact examination to reconstruct attacker activity andestablishincident timelines

• Participate in an on-call rotation and perform hands-on alert and incident analysis

• Analyze Microsoft 365 and Entra ID log sources including interactive sign-ins non-interactive sign-ins audit logs and the unified audit log

• Investigate EDR detections perform process tree analysis and recommend containment actions

• Triage and investigate escalations from the SOC

• Develop andmaintainautomated response playbooks

• Conduct root cause analysis anddetermineinitial access persistence and exfiltration methods during investigations

• Apply security engineering fundamentals to improve identity security conditional access and endpoint posture

• Produce clear executive-ready incident briefings IOC documentation and technical writeups

• Identifyand tune false positive patterns to improve detection fidelity

Required Qualifications

• 6 years in security operations detection engineering incident response or a combined security engineering role

• Demonstrated ability to build detections and understand the underlying logic not justoperatea tool

• Hands-on digital forensics experience across endpoint and cloud including artifact collection timeline reconstruction and evidence handling

• Proficiencyscripting and building automation (Python PowerShell KQL or similar) including the effective use of AI tooling to accelerate development

• Working knowledge of attacker tradecraft and the ability to attribute activity based on TTPs

• Experience building or consuming API integrations across security and identity platforms

• Proficiencywith EDR platforms

• Working knowledge of SIEM platforms and detection rule development

• Strong understanding of hybrid identity environments including AD Connect sync behavior and Entra ID

• Experience investigating modern attack techniques includingAiTMphishing OAuth consent abuse BEC token replay and living-off-the-land techniques

• Solid security engineering fundamentals across identity endpoint and cloud

• Willingness toparticipatein an on-call rotation and perform hands-on incident response

• Strong written communication and documentation discipline

Preferred Qualifications

• Demonstrated use of AI tools (such as Claude Copilot or similar) to accelerate detection engineering investigation workflows scripting and documentation

• Experience prompting and directing AI models to produce useful outputs in a security context including log analysis detection logic drafting and incident timeline construction

• Familiarity with Microsoft Sentinel including analytic rule development using KQL and automation via Logic Apps or Playbooks

• Familiarity with Microsoft Entra ID Purview and Defender Suite

• Hands-on experience with CrowdStrike Falcon including alert triage process tree analysis and prevention policy management

• Experience with identity security tooling such as Saviynt Entra ID Protection or similar IGA and privileged access platforms

• Prior experience in a large enterprise or managed security environment (5000 endpoints or 10000 users)

• Relevant certifications such as GCIA GCIH GCFE GCFA SC-200 AZ-500 or equivalent

What Youll Work On

This is a hands-on role with real ownership. You will build the detections that protect Greystar respond to the incidents they surface and continuously improve coverage based on what you learn in the field. You will write the automation that makes the team faster investigate live compromises and have direct input into detection strategy SIEM direction and identity security architecture. You will work directly with the Senior Manager of Cybersecurity Operations on initiatives including our SIEM migration to Microsoft Sentinel and ongoing detection engineering buildout.