Sr Detection and Response Engineer, Information Security

Sr Detection and Response Engineer, Information Security

Job Number: 82746

Reports To: Manager, Security Operations

FLSA Status: Exempt

Revision Date: 10/20/2026

General Summary

CommScope is seeking a Senior Detection and Response Engineer to serve as a L3 technical lead and escalation point in our Security Operations Center. This is a hands-on engineering role. You will own complex investigations and incident response end to end, and build the detections, automations, and AI-assisted workflows that let a lean team operate at scale.

You will work closely with our MDR partner and junior analysts, turning lessons learned from incidents into durable detection and response capability across a global IT and manufacturing (OT) environment. You will be expected to reduce manual effort, improve signal quality, and measurably shorten time to detect and respond.

CommScope’s security team protects the people, processes, and technologies that serve our customers, and their customers: the billions of people our products and services help connect every day.

Duties & Responsibilities

Incident Response and Escalation

- Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and our MDR provider. Lead investigations through containment, eradication, and recovery.

- Act as technical incident lead for high-severity events. Coordinate with IT, infrastructure, OT, and business stakeholders, and produce clear executive and technical incident reports.

- Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.

Detection Engineering

- Design, build, test, and tune detections in the SIEM and EDR (Microsoft Sentinel, CrowdStrike NG-SIEM) using KQL and related query languages. Map coverage to MITRE ATT&CK and CommScope’s top enterprise and OT threat scenarios.

- Own the detection lifecycle, including false-positive reduction, coverage gap analysis, and detection-as-code practices with version control and peer review.

- Engineer log pipelines and data quality with Cribl, so the telemetry needed for detection and investigation is complete, normalized, and cost-effective.

Automation and AI

- Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure. Target measurable reductions in analyst hours and MTTR.

- Design, test, and operationalize AI-assisted SOC workflows, such as Copilot agents, LLM-based triage and summarization, and guided playbook agents. Apply appropriate guardrails: least privilege, human approval for destructive actions, prompt-injection resilience, and output validation.

- Integrate security tooling through APIs and scripting (Python, PowerShell) to remove manual, repetitive work.

Threat Hunting and Intelligence

- Conduct hypothesis-driven threat hunts informed by current threat intelligence and actor TTPs, and convert findings into new detections.

- Assess emerging vulnerabilities and threats for CommScope exposure, and recommend prioritized response actions.

Program and Team

- Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises.

- Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer.

- Report on SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved.

- Participate in the on-call rotation (PagerDuty) as the senior escalation tier.

Accountability / Impact

Global CommScope footprint

Competencies

Manages Complexity : Makes sense of complex, high-volume, and sometimes contradictory security data to find root causes and resolve incidents.

Decision Quality: Makes sound, timely containment and response decisions based on analysis, experience, and judgment, and serves as a trusted source of technical advice.

Optimizes Work Processes : Continuously improves SOC workflows, automating manual and repetitive tasks to increase speed, consistency, and efficiency.

Tech Savvy: Anticipates the impact of emerging technologies, including AI, and adopts tools that deliver real value.

Action Oriented: Acts with urgency and decisiveness in fast-changing, unpredictable situations, and steps up to manage tough issues.

Being Resilient: Stays composed and effective under pressure, rebounding from setbacks while keeping incident response on track.

Communicates Effectively: Delivers clear, timely communication tailored to the audience, from technical incident details to executive summaries.

Required Qualifications for Consideration

- Bachelor’s in related curriculum such as

- Information Security, Computer Science, or related field (or equivalent experience )

- 6+ Years of Related Experience

Skills Required

Include demonstrated competencies and physical, mental, & interpersonal skills.

- 6+ years in information security, including 3+ years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent. Bachelor’s degree in a related field or equivalent professional experience.

- Proven experience leading investigations and response for significant security incidents in an enterprise environment.

- Advanced proficiency with SIEM and EDR platforms (Microsoft Sentinel and CrowdStrike NG-SIEM preferred), including authoring and tuning detections in KQL or similar.

- Hands-on experience building SOAR playbooks and automations. Scripting proficiency in Python and/or PowerShell, plus REST API integration.

- Practical experience applying AI or LLM tools to security operations (triage, enrichment, summarization, query generation), with a clear understanding of their risks and limits.

- Strong working knowledge of Windows, Linux, and macOS internals, Active Directory and Entra ID, email security, network protocols, and cloud (Azure/M365) attack surfaces.

- Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.

- Clear written and verbal communication, including incident reports for both technical and executive audiences.

- Self-directed, with sound judgment under pressure and the ability to prioritize across competing incidents and engineering work.

- DESIRED – Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.

- DESIRED – Experience with OT/ICS security monitoring in manufacturing environments.

- DESIRED – Experience with log pipeline tooling (Cribl), detection-as-code, and Git-based workflows.

- DESIRED – Experience working with an MDR provider.

Interview Exercises

- A live investigation exercise using a sample alert or log set, ending with a short written summary.

- A detection or automation design walkthrough. For example: write a KQL detection and describe how you would automate the response, including AI use and guardrails.