Senior Detection & Response Engineer

Job Description Summary

Greystar is seeking a Senior Detection & Response Engineer for its Cybersecurity Operations team. This hybrid engineering and operations role requires building detections, writing code and automation, executing full incident response investigations, and applying solid security engineering fundamentals across our environment. The engineer will own the full loop: design detection, respond to alerts, and iterate on lessons learned to strengthen coverage.

Responsibilities span EDR, IAM, SIEM, Data Governance and close collaboration with our SOC.

• Design, build, test, and tune detection rules across SIEM and security tooling to target real attack techniques observed in our environment.
• Build scripts, automation, and API integrations (using code and AI tooling) to accelerate detection engineering, investigation, and response workflows.
• Lead incident response investigations end‑to‑end, from triage through containment, eradication, and closure.
• Perform host and cloud forensic analysis, including disk, memory, and log artifact examination to reconstruct attacker activity and establish incident timelines.
• Participate in an on‑call rotation and perform hands‑on alert and incident analysis.
• Analyze Microsoft 365 and Entra  sources (interactive sign‑ins, non‑interactive sign‑ins, audit logs, unified audit log).
• Investigate EDR detections, perform process‑tree analysis, and recommend containment actions.
• Triage and investigate SOC escalations.
• Develop and maintain automated response playbooks.
• Conduct root cause analysis and determine initial access, persistence, and exfiltration methods during investigations.
• Apply security engineering fundamentals to improve identity security, conditional access, and endpoint posture.
• Produce clear, executive‑ready incident briefings, IOC documentation, and technical write‑ups.
• Identify and tune false‑positive patterns to improve detection fidelity.

• 6+ years in security operations, detection engineering, incident response, or a combined security engineering role.
• Demonstrated ability to build detections and understand underlying logic, not just operate a tool.
• Hands‑on digital forensics experience across endpoint and cloud, including artifact collection, timeline reconstruction, and evidence handling.
• Proficiency in scripting and automation (Python, Power Shell, KQL, or similar) and effective use of AI tooling to accelerate development.
• Working knowledge of attacker tradecraft and the ability to attribute activity based on TTPs.
• Experience building or consuming API integrations across security and identity platforms.
• Proficiency with EDR platforms.
• Working knowledge of SIEM platforms and detection rule development.
• Strong understanding of hybrid identity environments, including AD Connect sync behavior and Entra .
• Experience investigating modern attack techniques (AiTM phishing, OAuth consent abuse, BEC, token replay, living‑off‑the‑land).
• Solid security engineering fundamentals across identity, endpoint, and cloud.
• Willingness to participate in an on‑call rotation and perform hands‑on incident response.
• Strong written communication and documentation discipline.

• Demonstrated use of AI tools (such as Claude, Copilot, or similar) to accelerate detection engineering, investigation workflows, scripting, and documentation.
• Experience prompting and directing AI models to produce useful outputs in a security context (log analysis, detection logic drafting, incident timeline construction).
• Familiarity with Microsoft Sentinel (analytic rule development using KQL, automation via Logic Apps or Playbooks).
• Familiarity with Microsoft Entra , Purview, and Defender Suite.
• Hands‑on experience with Crowd Strike Falcon (alert triage, process‑tree analysis, prevention policy management).
• Experience with identity security tooling such as Saviynt, Entra , or similar IGA and privileged access platforms.
• Prior experience in a large enterprise or managed security environment (5,000+ endpoints or 10,000+ users).
• Relevant certifications (GCIA, GCIH, GCFE, GCFA, SC‑200, AZ‑500, or equivalent).

This hands‑on role features…