Cybersecurity Detection Engineer II -
Cox AutomotiveResponsibilities
- Build, test, tune, maintain, and retire security detections for Cox Automotive’s internal and customer-facing environments.
- Develop SIEM, EDR, and SOAR detection rules, alerts, automated remediation playbooks, and AI-assisted triage workflows.
- Use AI tools and large language models for detection development, query writing, log analysis, investigation, and documentation, validating outputs for accuracy.
- Map detections to MITRE ATT&CK and ATLAS, assess coverage, reduce false positives, and report detection performance metrics.
- Support SIEM and Data Lake log ingestion by onboarding sources, validating parsing and data quality, and troubleshooting ingestion issues.
- Perform attack simulation testing, support purple-team exercises, and collaborate with Incident Response, Threat Intelligence, Vulnerability Management, and other teams.
- Build threat detection logic during incidents and apply threat intelligence and emerging-threat research to improve detections.
- Maintain operational guidelines, diagrams, use-case documentation, processes, and configurations.
- Participate in an off-hours security detection and response support rotation.
Requirements
- Bachelor’s degree in a related discipline and two years of experience in a related field, or an alternative combination such as a master’s degree with up to two years of experience or 14 years of related experience.
- At least one year of Detection Engineering or Security Operations Center experience; SOC experience may substitute for direct Detection Engineering experience.
- Working knowledge of SIEM query languages such as SPL or KQL and hands-on SIEM log searching and analysis.
- Knowledge of information security, network security, security monitoring, and incident response fundamentals.
- Demonstrated daily use of AI tools and prompt engineering for security or technical work.
- Familiarity with threat intelligence, firewalls, IPS, endpoint security, DLP, SIEM/SOAR, and Data Lakes.
- Familiarity with security concepts in AWS, Azure, or GCP, with multi-cloud experience preferred.
- Understanding of the attack kill chain and MITRE ATT&CK framework.
- Preferred certifications include Security+, GSEC, GCIA, GCIH, SC-200, AWS Security Specialty, or similar.
- Preferred experience includes AI/ML security workflows, SOAR automation or Python scripting, DevOps, engineering, network or system administration, customer-focused detection systems, and OCSF.
Benefits
- Participation in an off-hours support rotation is required.
- The role supports domestic and international Cox Automotive businesses and collaborates with technical and non-technical stakeholders.
Tech Stack
Categories
About Cox Automotive
Cox Automotive is the world’s largest automotive services and technology provider. Fueled by the largest breadth of first- and third-party data fed by 2.3 billion online interactions a year, Cox Automotive tailors leading solutions for car shoppers, auto manufacturers, dealers, lenders and fleets. The company has 29,000+ employees on four continents and a portfolio of industry-leading brands that include Autotrader®, Kelley Blue Book®, Manheim®, vAuto®, Dealertrack®, NextGear Capital™, CentralDispatch® and Cox Fleet®. Cox Automotive is a subsidiary of Cox Enterprises Inc., a privately owned, Atlanta-based company with $23 billion in annual revenue. Cox Automotive has been included on Glassdoor’s Best Companies in Tech & AI 2026 and Best Place to Work in 2026 lists.