Security Engineer

Job Description #LI-CR2 #LI-Hybrid Responsibilities The Security Detection Engineer is a senior, hands-on technical role responsible for building, tuning, validating, and operating security detections across CBIZ environments. Detection engineering is the core of the role: translating threat intelligence, adversary behavior, incident findings, and business risk into dependable analytics that identify suspicious activity with useful context. The engineer also investigates incidents, improves supporting controls, and uses automation to increase speed, consistency, and coverage. This is not a passive monitoring or ticket-routing role; the engineer owns detection problems from use-case design and telemetry validation through deployment, triage support, measurement, and continuous improvement. Essential Functions and Primary Duties Detection Engineering and Threat Analytics Design, test, deploy, document, and maintain detection content across SIEM, XDR, NDR, identity, email, endpoint, network, cloud, and application security platforms. Turn threat intelligence, adversary tactics and techniques, incident findings, and business risk into prioritized detection use cases; develop behavioral, correlation, threshold, anomaly, and indicator-based analytics. Map detection coverage to recognized adversary behaviors and maintain clear traceability among threats, telemetry, analytics, response actions, and control owners. Validate detections through structured testing, historical-log review, attack simulation, purple-team exercises, and post-incident analysis; tune for meaningful signal while reducing false positives and duplicates. Own the detection lifecycle, including intake, prioritization, peer review, testing, release, version control, performance review, exception handling, and retirement. Monitor detection health, data freshness, rule execution, alert quality, and coverage gaps; drive corrective action when controls or telemetry degrade. Telemetry, Logging, and Detection Architecture Partner with cloud, identity, endpoint, network, infrastructure, and application teams to onboard, normalize, and retain security-relevant telemetry. Assess log quality and availability, including timestamps, identity context, event fidelity, field mapping, parsing, retention, and ingestion health required for reliable investigations and detections. Document data dependencies and recovery procedures for critical detections, and contribute to detection architecture, data-source strategy, and use-case roadmaps across hybrid and multi-cloud environments Security Operations, Incident Response, and Engineering Investigate and respond to alerts and incidents across SIEM, XDR, NDR, identity, email, endpoint, network, and cloud platforms; lead work from triage and scoping through containment, eradication, recovery, validation, and lessons learned. Perform root-cause analysis, reconstruct activity across data sources, preserve relevant evidence, validate remediation, and convert incidents, near misses, and control failures into improved detections, playbooks, and preventive controls. Configure, harden, maintain, and troubleshoot security controls across Microsoft Azure, Azure Virtual Desktop, AWS, and Microsoft 365 security and compliance platforms, including identity protection, Conditional Access, email defense, endpoint security, DLP, cloud workload protection, and tenant baselines. Support certificate-based authentication, encryption, and PKI dependencies; coordinate remediation and control changes with technology owners and confirm intended security outcomes. Participate in an on-call rotation and after-hours response as needed. Automation, Documentation, and Collaboration Use PowerShell, Python, Bash, APIs, SOAR workflows, and other automation methods to enrich alerts, test controls, improve data quality, orchestrate response, and reduce repetitive work. Build reusable queries, scripts, integrations, dashboards, investigation guidance, runbooks, playbooks, SOPs, and knowledge articles that improve operational consistency. Evaluate AI-enabled security capabilities responsibly to improve detection development and investigation efficiency while retaining appropriate human review and control. Partner with Security Operations, GRC, IT, Cloud, Networking, Systems, Endpoint, application owners, threat intelligence, vulnerability management, and red/purple teams; provide technical guidance and peer review when appropriate. Preferred Qualifications 3-5 years of experience in information security, security operations, detection engineering, incident response, threat hunting, or security engineering. Proven hands-on experience creating and tuning detections in an enterprise SIEM, XDR, or comparable security analytics platform. Strong ability to analyze authentication, endpoint, network, email, cloud, and application telemetry and translate findings into durable detection logic. Hands-on experience with security investigations, incident response, log analysis, root-cause analysis, and remediation validation. Working knowledge of adversary behavior, common attack techniques, detection lifecycle practices, and methods for validating detection coverage. Experience securing Azure and/or AWS environments and operating Microsoft 365 security capabilities; experience supporting or securing Azure Virtual Desktop is required. Working knowledge of PKI, certificate-based authentication, encryption, enterprise logging architectures, networking, identity and access, endpoint security, and malware fundamentals. Strong PowerShell skills and experience with Linux command-line administration, logs, and services; ability to work independently, exercise sound judgment, and drive complex work to completion. Advanced skill with SIEM query languages, detection-as-code, source control, testing frameworks, SOAR, APIs, and automated response. Experience with threat hunting, attack simulation, purple teaming, adversary emulation, breach-and-attack simulation, or measuring detection coverage and quality. Experience with AI-assisted security analytics and responsible use of AI in detection and response workflows. Relevant certifications such as Security+, GIAC, Microsoft security certifications, ISC2 CC or CISSP, or comparable credentials. Experience in a large enterprise SOC, hybrid or multi-cloud environment, or large-scale security transformation. Qualifications Minimum Qualifications Required College Degree or equivalent required 1 year related experience Proficient use of applicable technology Ability to follow technical instructions and guidelines Ability to document daily activities and system functions Able to work in team environment Demonstrated ability to communicate verbally and in writing throughout all levels of organization both internally and externally Ability to travel as required by business and on-call availability Able to lift up to 50 lbs About Us CBIZ, Inc. (NYSE: CBZ) is a leading professional services advisor to middle-market businesses nationwide. With industry knowledge and expertise in accounting, tax, advisory, benefits, insurance, and technology, CBIZ delivers actionable insights to help clients anticipate what is next and discover new ways to accelerate growth. CBIZ has more than 9,500 team members across 23 major markets coast to coast. CBIZ strives to be our team members' employer of choice by creating an environment where team members are appreciated, recognized for their contributions, and provided with opportunities to grow, both personally and professionally, throughout their careers. Together, CBIZ and CBIZ CPAs are ranked as one of the top providers of accounting services in the United States. CBIZ CPAs is an independent CPA firm that provides audit, review and attest services, while CBIZ provides business consulting, tax and financial services. In certain jurisdictions, CBIZ CPAs operates under its previous name, Mayer Hoffman McCann P.C. CBIZ