Sr Detection and Response Engineer, Information Security

In our ‘always on’ world, we believe it’s essential to have a genuine connection with the work you do. Sr Detection and Response Engineer, Information Security Job Number: 82746 Reports To: Manager, Security Operations FLSA Status: Exempt PLEASE NOTE : This is an onsite position located in the Charlotte, NC metro area.

Team members are expected to work from the office five days per week to support collaboration, innovation, and business objectives. General Summary Comm. Scope is seeking a Senior Detection and Response Engineer to serve as a L3 technical lead and escalation point in our Security Operations Center. This is a hands-on engineering role.

You will own complex investigations and incident response end to end, and build the detections, automations, and AI-assisted workflows that let a lean team operate at scale. You will work closely with our MDR partner and junior analysts, turning lessons learned from incidents into durable detection and response capability across a global IT and manufacturing (OT) environment.

You will be expected to reduce manual effort, improve signal quality, and measurably shorten time to detect and respond. Comm. Scope’s security team protects the people, processes, and technologies that serve our customers, and their customers: the billions of people our products and services help connect every day. Duties & Responsibilities Incident Response and Escalation Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and our MDR provider.

Lead investigations through containment, eradication, and recovery. Act as technical incident lead for high-severity events. Coordinate with IT, infrastructure, OT, and business stakeholders, and produce clear executive and technical incident reports. Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.

Detection Engineering Design, build, test, and tune detections in the SIEM and EDR (Microsoft Sentinel, Crowd. Strike NG-SIEM) using KQL and related query languages. Map coverage to MITRE ATT&CK and Comm. Scope’s top enterprise and OT threat scenarios. Own the detection lifecycle, including false-positive reduction, coverage gap analysis, and detection-as-code practices with version control and peer review.

Engineer log pipelines and data quality with Cribl, so the telemetry needed for detection and investigation is complete, normalized, and cost-effective. Automation and AI Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure. Target measurable reductions in analyst hours and MTTR.

Design, test, and operationalize AI-assisted SOC workflows, such as Copilot agents, LLM-based triage and summarization, and guided playbook agents. Apply appropriate guardrails: least privilege, human approval for destructive actions, prompt-injection resilience, and output validation. Integrate security tooling through APIs and scripting (Python, Power.

Shell) to remove manual, repetitive work. Threat Hunting and Intelligence Conduct hypothesis-driven threat hunts informed by current threat intelligence and actor TTPs, and convert findings into new detections. Assess emerging vulnerabilities and threats for Comm. Scope exposure, and recommend prioritized response actions.

Program and Team Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises. Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer. Report on SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved. Participate in the on-call rotation (Pager.

Duty) as the senior escalation tier. Accountability / Impact Global Comm. Scope footprint Competencies Manages Complexity : Makes sense of complex, high-volume, and sometimes contradictory security data to find root causes and resolve incidents. Decision Quality: Makes sound, timely containment and response decisions based on analysis, experience, and judgment, and serves as a trusted source of technical advice.

Optimizes Work Processes : Continuously improves SOC workflows, automating manual and repetitive tasks to increase speed, consistency, and efficiency. Tech Savvy: Anticipates the impact of emerging technologies, including AI, and adopts tools that deliver real value. Action Oriented: Acts with urgency and decisiveness in fast-changing, unpredictable situations, and steps up to manage tough issues.

Being Resilient: Stays composed and effective under pressure, rebounding from setbacks while keeping incident response on track. Communicates Effectively: Delivers clear, timely communication tailored to the audience, from technical incident details to executive summaries. Required Qualifications for Consideration Bachelor’s in related curriculum such as Information Security, Computer Science, or related field (or equivalent experience ) 6+ Years of Related Experience Skills Required Include demonstrated competencies and physical, mental, & interpersonal skills.

6+ years in information security, including 3+ years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent. Bachelor’s degree in a related field or equivalent professional experience. Proven experience leading investigations and response for significant security incidents in an enterprise environment.

Advanced proficiency with SIEM and EDR platforms (Microsoft Sentinel and Crowd. Strike NG-SIEM preferred), including authoring and tuning detections in KQL or similar. Hands-on experience building SOAR playbooks and automations. Scripting proficiency in Python and/or Power. Shell, plus REST API integration. Practical experience applying AI or LLM tools to security operations (triage, enrichment, summarization, query generation), with a clear understanding of their risks and limits.

Strong working knowledge of Windows, Linux, and macOS internals, Active Directory and Entra ID, email security, network protocols, and cloud (Azure/M365) attack surfaces. Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain. Clear written and verbal communication, including incident reports for both technical and executive audiences.

Self-directed, with sound judgment under pressure and the ability to prioritize across competing incidents and engineering work. DESIRED – Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or Crowd. Strike/Microsoft security certifications. DESIRED – Experience with OT/ICS security monitoring in manufacturing environments.

DESIRED – Experience with log pipeline tooling (Cribl), detection-as-code, and Git-based workflows. DESIRED – Experience working with an MDR provider. Why Comm. Scope: Comm. Scope is on a quest to deliver connectivity that empowers how we live, work, and learn. Our employees push the boundaries of communications technology that enables game-changing discoveries like 5G, the Internet of Things, and gigabit speeds for everyone, everywhere.

With our unmatched expertise in copper, fiber, and wireless infrastructure, our global clients rely on us to outperform today and be ready for the needs of tomorrow. If you want to grow your career alongside bright, passionate, and caring people who strive to create what's next…..come connect to your future at Comm. Scope.

Comm. Scope is an Equal Opportunity Employer (EEO), including people with disabilities and veterans. If you are seeking an accommodation for the application or interview process, please contact us to submit your request at [email protected]. You can also learn more about Comm. Scope’s accommodation process and EEO policy at https://jobs.

commscope.com/eeo ; ;