Cybersecurity Threat Detection – Automation Manager

🕒 September 16

🏈 Alabama, Alaska, +44 more states – Remote

🏈 Alabama – Remote 🐻 Alaska – Remote 🌵 Arizona – Remote 🏄 California – Remote ⛰️ Colorado – Remote 🦌 Connecticut – Remote 🐊 Florida – Remote 🌺 Hawaii – Remote 🥔 Idaho – Remote 🌽 Illinois – Remote 🌾 Iowa – Remote 🌪️ Kansas – Remote 🐎 Kentucky – Remote ⚜️ Louisiana – Remote 🦞 Maine – Remote 🦬 Montana – Remote 🌾 Nebraska – Remote 🎰 Nevada – Remote 🗻 New Hampshire – Remote 🏖️ New Jersey – Remote 🌶️ New Mexico – Remote 🗽 New York – Remote 🌲 North Carolina – Remote 🌾 North Dakota – Remote 🏈 Ohio – Remote 🌪️ Oklahoma – Remote 🌲 Oregon – Remote 🦀 Maryland – Remote 🍂 Massachusetts – Remote 🚗 Michigan – Remote ❄️ Minnesota – Remote 🎸 Mississippi – Remote 🏰 Missouri – Remote 🔔 Pennsylvania – Remote ⚓ Rhode Island – Remote 🌴 South Carolina – Remote 🗿 South Dakota – Remote 🎸 Tennessee – Remote 🤠 Texas – Remote ⛷️ Utah – Remote 🍁 Vermont – Remote ⚔️ Virginia – Remote ☕ Washington – Remote ⛰️ West Virginia – Remote 🧀 Wisconsin – Remote 🦬 Wyoming – Remote

⏰ Full Time

🟠 Senior

🔴 Lead

👮‍♂️ Cybersecurity / Security Engineer

👻 Ghost score 11%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Cummins Inc.

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 1919

🏗️ Construction

💼 Consulting

🏥 Healthcare

💰 $75M Grant on 2024-07

Construction • Consulting • Healthcare

Cummins Inc. is a global power technology leader that designs, manufactures, and distributes a variety of engines and power systems solutions. They offer products that range from diesel and natural gas engines to hybrid and electric power systems, as well as components like turbochargers, fuel systems, and emissions solutions. With a strong emphasis on innovation, Cummins aims to reduce emissions and improve fuel efficiency. The company is dedicated to helping industries navigate the transition to cleaner energy through integrated power solutions suitable for diverse applications such as on-highway, marine, mining, and construction. Additionally, Cummins provides services including remote monitoring, diagnostics, and aftermarket support, reinforcing its commitment to sustainability and customer service excellence.

📋 Description

• Manage, mentor, and develop a team of detection engineering and automation professionals • Define and execute the threat detection and automation strategy • Establish intake, prioritization, backlog management, planning, peer review, release readiness, metrics, and continuous improvement processes • Design, develop, tune, and optimize threat detection logic across SIEM, EDR, identity, cloud, email, network, OT, SaaS, and other security platforms • Own high-impact detections for complex use cases, critical risks, advanced adversary behaviors, and enterprise threats • Translate adversary tactics, techniques, and procedures into actionable analytics using MITRE ATT&CK, threat intelligence, incident findings, red team results, vulnerability exposure, and business risk • Conduct detection gap analysis and threat modeling • Build detection validation practices, including test cases, replay or verification methods, regression checks, tuning evidence, performance monitoring, and analyst feedback loops • Lead SIEM and SOAR detection and response workflows • Build and optimize SIEM content, correlation rules, dashboards, risk-based alerts, data models, investigation views, and alert enrichment • Develop SOAR playbooks for enrichment, triage, evidence collection, case creation, containment recommendations, response actions, and analyst decision support • Drive integrations across SIEM, SOAR, EDR, email security, identity, threat intelligence, ITSM, cloud, network, PAM, DLP/CASB, and OT monitoring platforms • Manage the detection and automation roadmap and lifecycle from intake through retirement • Develop program metrics covering detection coverage, alert fidelity, false positives, automation value, telemetry readiness, backlog health, throughput, and investigation quality • Maintain audit-ready documentation and communicate strategy, risk coverage, roadmap, and outcomes to technical, non-technical, and executive stakeholders

🎯 Requirements

• 10+ years of cybersecurity experience working in SOC and in creating SIEM correlations/detections and automating incident information enrichment tasks • Master’s degree in Cybersecurity, Information Security, Computer Science, Engineering, or a related discipline (preferred) • Experience building mature detection lifecycle practices, including intake, prioritization, testing, tuning, monitoring, regression checks, peer review, and controlled releases • Experience building SOAR playbooks and automation workflows • Experience with detection-as-code, Git-based content management, CI/CD pipelines, automated testing, reusable detection templates, and scalable engineering patterns • Experience operationalizing threat intelligence into detection priorities, hunting queries, enrichment workflows, and response playbooks • Experience designing detections for identity-based attacks, endpoint, email, network, cloud, SaaS, OT/ICS, DLP, and privileged access use cases • Experience working in large, complex enterprise or manufacturing environments • Experience partnering with SOC, Incident Response, Threat Intelligence, Vulnerability Management, Cloud, Identity, Network, OT, Legal, Privacy, GRC, and IT teams • Excellent analytical and problem-solving skills • Demonstrated ability to lead, coach, and advise team members across cultural, geographic, technical, and generational boundaries • Proficiency in Splunk SPL, risk-based alerting, notable events, dashboards, correlation searches, SOAR, MITRE ATT&CK, EDR, CNAPP, network telemetry, OT/ICS monitoring, PAM, ITSM, Git, and CI/CD