Cybersecurity Detection Engineer II

Position: Cybersecurity Detection Engineer II -
Company Cox Automotive - USAJob Family Group Information Technology Job Profile Cybersecurity Engineer II Management Level Individual Contributor Flexible Work Option Hybrid - Ability to work remotely part of the week Travel %
No

Work Shift Day Compensation Compensation  includes a base salary in the range of $89,400.00 - $. The base salary may vary within the anticipated base pay range based on factors such as the ultimate location of the position and the selected candidate’s knowledge, skills, and abilities. Position may be eligible for additional compensation that may include an incentive program.

Job Description Cox Automotive is seeking a Cybersecurity Engineer II to join our Detection Engineering team, supporting next-generation Cyber Defense across our diverse portfolio of automotive solutions including Dealer track, Manheim, Autotrader, Kelley Blue Book, Central Dispatch, and vAuto.

Reporting to the Director of Cyber Detection Engineering, you’ll build, tune, and maintain enterprise- and customer-focused detection capabilities, including AI-assisted detection workflows and automation, with guidance and support from senior engineers on the team. You’ll work closely with Incident Response, Threat Intelligence, and Vulnerability Management to strengthen detection coverage. The ideal candidate has solid hands-on experience with SIEM log analysis gained in detection engineering or a SOC, a working knowledge of Incident Response and Threat Intelligence, and uses AI tools daily to work faster and smarter.

Strong verbal and written communication skills and a drive to keep learning are essential.

What You’ll DoCybersecurity Detection Engineering:

Build, test, and maintain detections that protect Cox Automotive’s internal systems as well as its domestic and international businesses.

Contribute to the Detection Engineering roadmap and objectives by delivering assigned work and recommending improvements to senior engineers.

Use AI tools and large language models daily to accelerate detection development, query writing, log analysis, investigation, and documentation, and validate AI output for accuracy before use.

Build and maintain AI-assisted detection and triage workflows (such as prompts, agent steps, and automated enrichment) as part of detection solutions, following established patterns and guidance from senior engineers.

Develop and tune detection rules, automated remediation playbooks, and alerts using SIEM, EDR, and SOAR platforms, tailored to Cox Automotive’s enterprise and customer threat landscape.

Use the MITRE ATT&CK and ATLAS frameworks to map detections, assess coverage, and help identify gaps.

Monitor detection performance and tune detections to reduce false positives and improve effectiveness.

Collaborate with the Threat Detection and Response team to continuously improve the identification and response to threats.

Perform attack simulation testing to validate the efficacy of detection use cases, using established tools and procedures.

Support purple teaming exercises in collaboration with the Vulnerability Management team.

Support SIEM/Data Lake log ingestion by onboarding log sources, validating parsing and data quality, and troubleshooting ingestion issues, in collaboration with Cyber Defense Engineering counterparts.

Evaluate, validate, tune, and recommend retirement of detections as needed.

Collect and report detection metrics, such as alert volume, false positive rates, and coverage, on a routine basis.

Build and maintain operational guidelines, diagrams, and documentation for security detection and response.

Participate in an off-hours support rotation for security detection and response activities.

Incident Response:

Collaborate with the Incident Response team to support rapid…