Cybersecurity Detection & Response Engineer

We need to output HTML fragment with sections: Overview (maybe not a heading? The overview is prose). The instructions: use

for section headings (e.g., About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). Do NOT repeat the job title as a heading. Include a section only when posting has real, specific content. So we need sections: Overview? Not listed as a heading type but we could treat as maybe "About the role"? The overview is about company, not role. Could be "About the role"? Not exactly. The instructions list possible headings; we can use any of those if content matches. We have content: Overview (company description). Could be "About the role"? Not exactly. Maybe we can omit heading for overview and just put

for overview prose. Then we have Responsibilities (we have a Responsibilities section). Then we have Salary Range (Pay). Then we have Key Accountabilities (maybe part of Responsibilities? Could be separate but we can incorporate into Responsibilities). The instructions: Use

• for any list of duties/requirements/benefits. So we need to list responsibilities as list items. Also qualifications as list. Benefits: they mention medical, dental, vision insurance, 401K, continuing education, employee assistance program, Impact Network Groups. That's benefits. So we need a Benefits section with list. Pay: we have salary range. Schedule: not mentioned, so omit. Skills: maybe we can include Key Competencies as Skills. Or we could put under Qualifications. The instructions: prefer a few substantive sections over many thin ones. So we could combine Qualifications & Education Requirements into a Qualifications section (list). Key Competencies could be Skills section (list). Benefits separate. Pay separate. Overview as prose. Responsibilities as list. We must not include boilerplate like EEO, etc. Remove duplicated lines. Also remove "Old National is proud to be an equal opportunity employer..." etc. Also remove "We do not accept resumes from external staffing agencies..." etc. Also remove "Join our team!" etc. We must preserve all substantive information. So we need to include the company overview paragraph, responsibilities bullet list, key accountabilities maybe merged into responsibilities? The responsibilities section already includes bullet points under "Responsibilities". Then there is "Key Accountabilities" with sub-bullets. We could treat those as further responsibilities; we can combine them into a single list under Responsibilities heading. Or we could keep separate headings but risk thin sections. Better to combine. Similarly, "Key Measures of Success / Key Deliverables" could be considered as part of Responsibilities or maybe as Skills? It's more about outcomes. Could be omitted? But it's substantive. Could be included under Responsibilities as additional bullet points. We need to ensure we don't invent or summarize away detail. So we need to keep all details. Let's extract content: Overview paragraph: "Old National Bank has been serving clients and communities since 1834. With over $70 billion in total assets, we are a regional powerhouse deeply rooted in the communities we serve. As a trusted partner, we thrive on helping our clients achieve their goals and dreams, and we are committed to social responsibility and investing in our communities through volunteering and charitable giving. We continually seek highly motivated and talented individuals as our people are critical to our success. In return, we offer competitive compensation with our salary and incentive program, in addition to medical, dental, and vision insurance. 401K, continuing education opportunities and an employee assistance program are also included in our benefit suite. Old National also offers a variety of Impact Network Groups led by team members who are passionate about driving engagement, creating awareness of diverse backgrounds and experiences, and building inclusion across the organization. We offer a unique opportunity to join a growing, community and client-focused company that is firmly rooted in its core values." That's overview. Responsibilities: The Cybersecurity Detection and Response Engineer administers , engineers, and improves ONB’s security monitoring and response platforms, with primary focus on Microsoft Sentinel and Microsoft Defender XDR. This role builds and tunes detections, supports complex investigations, partners with third-party monitoring providers to receive and triage escalations, automates repeatable security workflows, and uses modern tools—including AI-assisted analysis—to improve speed, accuracy, and consistency across security operations. Then Key Accountabilities bullet list: - Detection Engineering & Threat Detection - Develop and maintain detection use cases based on threat intelligence, emerging attack techniques, and MITRE ATT&CK. - Conduct validation testing, threat hunting, and participate in red/ purple-team testing to evaluate detection effectiveness. - Identify monitoring gaps and implement improvements to coverage, telemetry, and response processes. - Partner with SOC analysts, IT teams, and third-party providers to improve investigation quality and operational outcomes. - Security Automation & SOAR - Design and maintain Sentinel playbooks, Logic Apps, APIs, and automation workflows. - Automate repetitive SOC processes to improve response speed, consistency, and analyst efficiency. - Evaluate and responsibly apply AI-assisted capabilities to support investigation, summarization, triage, detection development, and operational improvement. - Incident Response Support - Serve as an escalation resource for complex security events and investigations. - Support incident response through data analysis, evidence collection, and investigative support. - Maintain practical playbooks, response procedures, and after-action improvement recommendations. - Continuous Improvement - Research emerging threats, vulnerabilities, defensive capabilities, and practical uses of AI in security operations. - Support audit, regulatory, and governance needs including FFIEC, NIST, and applicable banking requirements. - Continuously improve monitoring, response, automation, and operational processes. Key Competencies for Position (Skills): - Technical depth: Strong understanding of Sentinel, Defender XDR, KQL, detection engineering, automation, and incident response. - Investigative judgment: Able to analyze complex events, identify root cause , and develop practical risk-based improvements. - Communication and partnership: Clearly explains technical issues and works effectively across security, IT, risk, and business teams. - Continuous improvement mindset: Seeks opportunities to improve security operations through automation, AI-assisted workflows, and better detection outcomes. Qualifications & Education Requirements: - Required Qualifications - Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or equivalent experience. - Minimum 4 years of cybersecurity experience, including security monitoring, incident response, or detection engineering. - Experience administering Microsoft Sentinel and Microsoft Defender XDR technologies. - Strong KQL skills and experience developing detection logic, dashboards, or hunting queries. - Experience with scripting or automation such as PowerShell, Python, APIs, Logic Apps, or similar tools. - Working knowledge of MITRE ATT&CK, endpoint security, log analysis, and regulated security environments. - Interest in responsibly using AI-assisted tools to improve security operations, investigation, automation, and documentation. - Preferred Qualifications - SC-200, AZ-500, CISSP, GCIH, GCIA, GCFA, or equivalent certifications. - Experience in banking, financial services, or other regulated industries where security programs must be measured, documented, tested, and audit-defensible . - Practical experience using AI-assisted tools to accelerate investigation, summarize security data, generate or refine detection logic, improve documentation, or support automation workflows. - Hands-on experience with security automation, orchestration, AI-assisted analysis, or response technologies. Key Measures of Success / Key Deliverables: - Improves detection accuracy, reduces false-positive volume, and strengthens SOC visibility. - Develops and maintains high-quality Sentinel detections, Defender XDR improvements, workbooks, dashboards, and automation workflows. - Supports timely response to security events and complex investigations. - Operationalizes new telemetry, monitoring capabilities, and AI-assisted efficiencies where appropriate . - Proactively communicates status, risks, obstacles, and recommendations to leadership and stakeholders. Pay: Salary Range The salary range for this position is $77,900/yr - $153,000/yr plus bonus. The base salary indicated for this position reflects the compensation range applicable to all levels of the role across the United States. Actual salary offers within this range may vary based on a number of factors, including the specific responsibilities of the position, the candidate’s relevant skills and professional experience, educational qualifications, and geographic location. Benefits: medical, dental, vision insurance. 401K, continuing education opportunities and an employee assistance program are also included in our benefit suite. Old National also offers a variety of Impact Network Groups led by team members who are passionate about driving engagement, creating awareness of diverse backgrounds and experiences, and building inclusion across the organization. Schedule: not mentioned. We need to avoid duplication: The overview already mentions benefits similar to benefits section; we should not duplicate. But we need to preserve all substantive information. The overview includes benefits description; the benefits section also includes same. To avoid duplication, we could keep overview as is and not repeat benefits separately, or we could keep benefits section and trim overview benefits mention. The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." If we remove benefit details from overview, we lose that info unless we keep it elsewhere. We could keep overview without benefit details, and then have a Benefits section with those details. But overview currently includes benefit details; we could edit overview to remove those sentences, but that would be summarizing away detail (removing). However we could keep overview as is and also have Benefits section; that would duplicate benefit details, which is duplication but not inventing. The instruction says remove duplicated lines. So we should avoid duplicate content. So we need to decide where to place benefit info once. Probably best to keep overview focused on company description, and move benefit details to Benefits section. But we must ensure we don't lose any substantive info: we can rephrase overview to exclude benefit details, but that's altering original text (removing). That's allowed as we are not inventing; we are just omitting duplicate? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." If we omit benefit details from overview but include them in Benefits section, we still preserve all info (just moved). That's okay. However we are altering the overview text (removing sentences). That's not inventing, but is it summarizing away detail? We are not summarizing; we are just moving detail to another section. That should be fine. Thus we will produce overview paragraph without benefit sentences. Let's craft overview: "Old National Bank has been serving clients and communities since 1834. With over $70 billion in total assets, we are a regional powerhouse deeply rooted in the communities we serve. As a trusted partner, we thrive on helping our clients achieve their goals and dreams, and we are committed to social responsibility and investing in our communities through volunteering and charitable giving. We continually seek highly motivated and talented individuals as our people are critical to our success. We offer a unique opportunity to join a growing, community and client-focused company that is firmly rooted in its core values." Now Benefits section: list medical, dental, vision insurance; 401K; continuing education opportunities; employee assistance program; Impact Network Groups. Pay section: salary range paragraph. Responsibilities section: combine the role description paragraph plus the key accountabilities bullet list plus key measures of success bullet list maybe as part of responsibilities. Could be separate but risk thin. We'll make Responsibilities section with a paragraph intro then a
  list of duties (including all bullet points). We'll need to flatten the nested bullets into a single list? The instruction: Use
  • for any list of duties/requirements/benefits. It doesn't forbid nested lists, but we can keep simple list items; we could have sub-items as separate
  • but maybe we can keep them as separate list items with indentation via text. Simpler: just make each bullet a top-level
  • . We'll include all bullet points from Key Accountabilities and Key Measures of Success, plus the initial role description sentence maybe as a
  • or as a preceding

    . We'll put the role description as a

    before the