Senior Cybersecurity Engineer, Defense Operations

What You’ll Be Doing:

• Act as a frontline incident responder, from detection and containment to eradication, remediation, and recovery. Facilitate post-incident reviews to drive continuous improvement in securing our people, information, and systems.
• Collaborate closely with our 3rd-party managed detection and response provider as the primary APAC region interface for incident triage, escalation, and threat hunting activities.
• Administer, monitor, and continuously optimize our core Defense Operations toolset including logging and monitoring (SIEM), endpoint detection and response (EDR), cloud security, email security, and vulnerability management services.
• Enhance cloud security operations across processes and tooling in collaboration with internal cybersecurity and engineering teams.
• Drive other Motional teams (DevOps, IT, HR, Engineering) to proactively identify, assess, and mitigate cybersecurity risks.
• Provide technical strategy and expertise to Motional’s end to end vulnerability management program, helping stakeholders address significant vulnerabilities in a timely manner.
• Design, document, and operationalize security procedures, playbooks, and runbooks for key Defense Operations functions, specifically those involving Managed Detection and Response (MDR) or other third-party security service providers

What We’re Looking for:

• BS or MS in Computer Science, Cybersecurity, Information Systems, Information Technology or equivalent knowledge and work experience.
• 5+ years of full-time, hands-on experience in a cybersecurity operations, SOC, incident response, or cybersecurity engineering role.
• Proven ability to analyze security alerts and logs from a wide range of cybersecurity and IT tools (SIEM, EDR, SEG, CNAPP, IAM, OS logs, application logs, etc.).
• Expertise in investigating and responding to cybersecurity incidents within frameworks such as NIST, ISO, or others. 
• Strong understanding of cloud-native security concepts and best practices, preferably with exposure to AWS.
• Background in deploying, administering, and using SIEM and/or EDR tools (e.g. Splunk, Microsoft, Crowdstrike).
• Vulnerability management skills including vulnerability scanning and CVE impact analysis.
• Ability to support security automation through basic scripting (e.g. Python, bash, Powershell)
• Excellent analytical, problem-solving, and troubleshooting skills.
• Strong written and verbal communication skills, including the ability to document technical information and present to diverse audiences.
• Ability to work independently and as part of a team in a fast-paced environment.
• Demonstrated experience in leveraging and collaborating with 3rd-party managed detection and response security partners.
• Curious and security focused mindset

Bonus Points:

• Familiarity with identity and access management tools and concepts are helpful for the role, even when not directly managing those tools (e.g. Okta, SSO, SAML).
• Terraform experience is beneficial