Detection and Response Engineer

Job not on LinkedIn

🔥 51 minutes ago

🏄 California – Remote

🏄 California – Remote

💵 $124k - $229.4k / year

⏰ Full Time

🟠 Senior

🔴 Lead

👷🏻‍♀️ Engineer

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

XBOX

WebsiteLinkedInAll Job Openings

10,000+ employees

Founded 2001

🎮 Gaming

🔧 Hardware

👥 B2C

Gaming • Hardware • B2C

XBOX is Microsoft’s consumer gaming brand and platform. It designs and sells video game consoles (Xbox Series X and Series S), first- and third-party games and accessories, and operates digital services such as the Microsoft Store for games, Xbox Game Pass subscription and Xbox Cloud Gaming. Xbox also provides PC and mobile gaming access, community and support services, and integrates with Microsoft accounts and other Microsoft products.

📋 Description

• Detect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands-on TDIR team member • Monitor and analyze security telemetry and audit logs to identify anomalous activity, unauthorized access, emerging threats, targeted attacks, and advanced adversaries • Perform alert triage, in-depth investigation, and forensic analysis through containment, remediation, and post-incident review • Execute endpoint, identity, cloud, and malware investigations, including timeline reconstruction, indicator extraction, and root cause analysis • Develop, refine, and tune SIEM threat detections based on attacker behavior and investigation findings • Improve investigation and response efficiency through automation, SOAR workflows, scripting, and advanced analytics • Design, build, or operate AI/LLM-assisted triage and enrichment workflows • Evaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict-poisoning risks • Contribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics • Collaborate with engineering teams, business stakeholders, and vendors during investigations and response efforts • Participate in an on-call rotation and provide off-hours support for critical incidents and material security events • Communicate investigation findings to technical teams and leadership • Travel occasionally, up to approximately 10%, to support studios or on-site incident response

🎯 Requirements

• Bachelor’s degree in computer science, Information Security, or equivalent practical experience • 10+ years of progressively accountable security experience • Hands-on experience in threat detection, security operations, and incident response across the full incident lifecycle • Strong understanding of the modern threat landscape, attacker tactics, techniques, and procedures • Proven ability to detect, triage, investigate, and respond to security incidents in enterprise environments • Experience with detailed log analysis, correlation, and investigative triage • Strong written and verbal communication skills • Ability to work independently and collaboratively with technical and business stakeholders • Willingness to participate in an on-call rotation and provide off-hours support • Hands-on experience with SIEM and EDR platforms, including building or significantly extending detection content • Scripting or programming experience such as Python, PowerShell, or KQL • Strong host- and network-based forensic skills, including timeline reconstruction and root cause analysis • Working knowledge of LLM applications in security operations and related failure modes • Fluency in English • Preferred: 12+ years of relevant IT and security experience, leadership or mentorship experience, malware analysis, SOAR, AI-assisted triage, identity-focused detection, security hardening, leadership/vendor interfacing, and cybersecurity community engagement

🏖️ Benefits

• Medical, dental, vision, health savings account or health reimbursement account, healthcare spending accounts, dependent care spending accounts, life and AD&D insurance, disability insurance • 401(k) with Company match • Tuition reimbursement • Charitable donation matching • Paid holidays and vacation • Paid sick time • Floating holidays • Compassion and bereavement leaves • Parental leave • Mental health & wellbeing programs • Fitness programs • Free and discounted games • Voluntary benefit programs including supplemental life & disability, legal service, ID protection, and rental insurance • Relocation assistance may be available if the Company requires geographic relocation • Incentive compensation may be available; not guaranteed