IT Security Engineer IV

About the role

Location: Frisco, TX & San Diego, CA. Duration: 6+ months (possibility of extension).

Responsibilities

• Administer and enhance the ServiceNow Security Incident Response (SIR) module: security incident workflows, assignment and escalation rules, SLA definitions, form and UI configuration, and integrations with SIEM, SOAR, and threat intelligence sources.
• Design, build, and maintain the Detection-as-Code (DaC) pipeline: detection development, version control, CI/CD-based testing, and automated deployment.
• Develop and tune detections across EDR, cloud, network, email, and DLP telemetry.
• Build SOAR playbooks, API integrations, and automation to streamline SOC workflows.
• Support administration and optimization of the SIEM/SOAR platform stack.
• Contribute to AI SOC initiatives: investigation coverage expansion, alert triage automation, and integration health.
• Apply MITRE Telecommunication & CK mapping, FP-rate gating and detection lifecycle standards to all deployed content.
• Partner with SOC analysts and incident response to translate operational gaps into engineering solutions.

Skills

• Proven SOC experience (detection engineering, security engineering, or senior analyst capacity) with a demonstrable engineering mindset.
• Hands-on experience administering the ServiceNow Security Incident Response (SIR) module: configuring security incident workflows, business rules, assignment logic, and SIEM/SOAR/API integrations, and maintaining the module in a production SOC environment.
• Hands-on automation and scripting, primarily Python, and experience building or contributing to Detection-as-Code pipelines.
• Strong grounding in MITRE Telecommunication & CK, Pyramid of Pain, Cyber Kill Chain, and the incident response process and its phases.
• Deep understanding of at least one of: endpoint security (macOS and Windows internals, telemetry, detection) or cloud infrastructure (cloud-native services, Kubernetes, runtime detection).
• Solid networking fundamentals, including DNS.
• Working knowledge of IAM, SSO (SAML/OIDC), and Zero Trust architecture concepts.
• Working knowledge of Data Loss Prevention concepts and detection use cases.
• Understanding of AI Detection & Response: securing and monitoring AI/LLM usage in the enterprise.
• Familiarity with agentic AI frameworks and applying AI to SOC operations and detection engineering workflows.
• Preferred: ServiceNow certifications relevant to the platform (e.g., Certified System Administrator, Security Incident Response implementation experience).
• Preferred: CI/CD tooling (Git, GitHub Actions or similar) for security content deployment.
• Preferred: Experience integrating AI/LLM capabilities into SOC triage or detection pipelines.
• Preferred: Familiarity with Risk-Based Alerting concepts.

Requirements

Education Required: Bachelor’s degree in an IT-related or Engineering field.

Education Preferred: Bachelor’s degree in an IT-related or Engineering field.

Benefits

• Comprehensive healthcare coverage (medical, dental, and vision plans)
• Supplemental coverage (accident insurance, critical illness insurance and hospital indemnity)
• 401(k)-retirement savings
• Life & disability insurance
• Employee assistance program
• Identity theft protection
• Legal support
• Auto and home insurance
• Pet insurance
• Employee discounts with preferred vendors

Pay

$80.00 - $85/hour DOE

Schedule

Hybrid schedule