Cybersecurity Engineer II

Cox Automotive seeks a Customer Security Analyst II to identify and defend against threats affecting the enterprise and customers, with support for fraud investigations and a focus on reducing customer risk.

Responsibilities

• Investigate and respond to threats including account takeover, credential abuse, phishing, and fraud; provide forensic support for fraud investigations.
• Provide after-hours support as needed for response activities.
• Partner with business operations, Product, and Cybersecurity teams to reduce customer impact and improve threat response.
• Support projects to implement technologies and controls to prevent and identify malicious behavior and customer-impacting fraud.
• Operate and support security tooling including SIEM and log analytics, SOAR, threat intelligence, EDR, email protection, cloud security, IDS/IPS, and Zero Trust technologies.
• Conduct threat analysis using industry frameworks such as MITRE ATT&CK, kill chain, and diamond model.
• Investigate account compromise by analyzing authentication, API, and application logs to reconstruct attacker activity and identify other impacted customers.
• Use AI-based tools to speed investigation, triage, and improve problem-solving.
• Use AI and automation to streamline SOC processes and improve threat detection, including detection logic and fraud signals.
• Turn threat findings into detections and protections that enhance the customer security program.
• Propose and help review security plans, policies, and customer protections.
• Maintain metrics, playbooks, and documentation for the customer security program, including fraud trends.
• Produce threat intelligence and fraud reports for security, business, and product stakeholders.
• Stay current on emerging threats, fraud schemes, and AI-driven attack techniques targeting customers; act quickly to protect the enterprise and customers.
• Assist with investigation and resolution of security events and incidents.

Requirements

• Bachelor’s degree in a related discipline and 2+ years of experience in a related field; alternative pathways include a master’s degree with up to 2 years experience, or 14 years experience in a related field.
• Hands-on experience in threat intelligence and incident response.
• Hands-on experience with industry-standard security technologies such as firewalls, VPN, IDS/IPS, SASE, secure web proxy, EDR/XDR, SIEM, and SOAR.
• Strong digital forensics and analytical problem-solving skills.
• Working knowledge of major cloud platforms (AWS, Azure, GCP), including architectures and native security services.
• Proficiency with query and scripting languages such as SPL, KQL, Python, and PowerShell for threat hunting, analysis, and automation.

Technologies

• SIEM, log analytics, SOAR, threat intelligence, EDR, email protection, cloud security, IDS/IPS, Zero Trust technologies
• MITRE ATT&CK, kill chain, diamond model
• Authentication logs, API logs, application logs
• Firewalls, VPN, SASE, secure web proxy
• EDR/XDR, AWS, Azure, GCP
• SPL, KQL, Python, PowerShell

Benefits

• Flexibility to take as much vacation with pay as consistent with duties, company needs, and obligations.
• Seven paid holidays throughout the calendar year.
• Up to 160 hours of paid wellness annually for the employee or family members.
• Additional paid time off including bereavement leave.
• Time off to vote.
• Jury duty leave.
• Volunteer time off.
• Military leave.
• Parental leave.

Compensation

• Base salary range: $89,400 - $134,000 per year.
• Base pay may vary within the anticipated range based on location and the selected candidate’s knowledge, skills, and abilities.
• May be eligible for additional compensation that may include an incentive program.