Security Operations Engineer II

Credit Acceptance is proud to be an award-winning company recognized both locally and nationally across multiple workplace categories. Our world-class culture is shaped by dedicated team members who are driven to succeed as professionals individually and together as a team. Backed by a strong product, exceptional people, and a stable financial foundation, we’ve grown into a leading provider of used and new car financing across the country.

Our Engineering and Analytics Team Members utilize the latest technology to develop, monitor, and maintain complex practices that help optimize our success. Our Team Members value being challenged, are encouraged to express their ideas, and have the flexibility to enjoy work life balance. We build intrinsic value by partnering with all functions of our business to support their success and make strategic business decisions.

We focus on professional development and continuous improvement while enjoying a casual work environment and Great Place to Work culture!

As a Security Operations Engineer II, you will engineer, operate, and automate capabilities that support the company’s Cyber Defense program. You will maintain security platforms and perform initial triage of cybersecurity incidents. You will work with incident responders and technology teams to improve detection, containment, and recovery. Success in this role means reliable security services, faster response, and less manual work.

• This position will work from home; occasional planned travel to an assigned Southfield, Michigan office location may be required.
• However, this position is permitted to work at a Southfield, Michigan office location if requested by the team member.
• Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services.
• Maintain next‑generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, or data‑quality issues.
• Maintain endpoint detection and response capabilities; support investigations and approved containment actions.
• Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues.
• Support web application protections with network and application teams; help implement rules, logging, integrations, and approved exceptions.
• Perform initial triage of cybersecurity alerts and incidents; gather evidence, document findings, determine scope, and elevate as needed.
• Support approved containment, remediation, and recovery actions across enterprise and cloud environments.
• Develop and tune detection logic to improve signal quality and investigative value.
• Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.
• Use Infrastructure as Code, version control, testing, and change‑management practices to maintain approved Cyber Defense resources.
• Use AI‑assisted workflows to improve analysis and efficiency while applying access controls, testing, human oversight, and audit requirements.
• Monitor platform health; maintain technical documentation; share knowledge; and participate in security projects and the on‑call rotation.
• Other Perform all other duties as assigned.
• Participate in on‑call rotations, including nights, weekends, and holidays.
• Remains compliant with our policies, processes and legal guidelines.
• Works primarily remotely with some occasional travel to a Credit Acceptance building.

• Customer Empathy:
  Customer Empathy is the ability to understand the perspectives, pain points, and experiences of customers. It involves actively putting oneself in the customer’s shoes, comprehending their needs…