Sr. Security Engineer

Sinclair Broadcast Group is seeking a Senior Information Security Engineer to strengthen Security Operations across on-premises, cloud, identity, and endpoint environments. In this role, you will drive complex incident response activities and engineer high-fidelity detections, while expanding SecOps automation with AI-assisted analysis and agent-based capabilities where they fit operational workflows.

Role focus

• Security Operations, incident response, and advanced detection engineering
• Leading complex incident investigations from triage through recovery
• Building behavior, context, and risk-based detections across endpoint, identity, network, email, and cloud telemetry
• Improving investigation quality and response effectiveness using threat-informed methodologies

Responsibilities

• Lead technical investigation, triage, containment, eradication, and recovery for complex security incidents across on-premises, cloud, identity, and endpoint environments.
• Analyze security telemetry, authentication activity, process execution, network traffic, and threat intelligence to determine root cause, attack scope, impact, and appropriate response.
• Conduct proactive threat hunting and retrospective investigations; identify gaps in telemetry, detections, and response capabilities.
• Own high-severity incident investigations, document evidence-based findings, communicate business impact, and coordinate timely remediation with system owners and external partners.
• Use MITRE ATT&CK and other threat-informed methodologies to improve investigation quality, detection coverage, and response effectiveness.
• Apply independent technical judgment, clear communication, and accountability for outcomes in time-sensitive situations.
• Design, develop, test, deploy, and continuously tune complex detection mechanisms for multi-stage attacks including identity compromise, lateral movement, persistence, exfiltration, and related adversary behaviors.
• Correlate endpoint, SIEM, identity, email, network, and cloud telemetry to create behavioral, contextual, and risk-based detections rather than relying solely on static indicators.
• Develop and maintain detection-as-code content, queries, analytics, and validation tests; assess false positives, data quality, precision, and detection gaps.
• Design, implement, and maintain automated SecOps and incident response workflows using security platforms, APIs, SOAR technologies, and enterprise ticketing systems to streamline enrichment, investigation, containment, and remediation.
• Advance security operations automation by integrating AI-assisted analysis and agent-based capabilities into existing investigation and response processes to improve context, prioritization, and analyst efficiency.
• Apply security engineering controls to automated response workflows, including least-privilege access, action validation, approval for high-impact remediation, logging, exception handling, and escalation to analysts.
• Integrate third-party alert and investigation outputs with internal telemetry to support independent validation, deeper investigation, and consistent remediation.
• Collaborate with infrastructure, IAM, cloud, endpoint, IT operations, and external security partners to validate detections, remediate threats, and operationalize new capabilities.
• Measure and improve detection coverage, fidelity, mean time to detect/respond, investigation quality, automation success, and analyst effort saved.
• Continuously test detections and response workflows using attack simulations, adversary emulation, incident lessons learned, and controlled validation.
• Document engineering designs, investigation procedures, response decision criteria, automation safeguards, and operational runbooks.
• Identify repetitive analyst tasks suitable for automation while preserving human oversight for uncertain, destructive, or business-disruptive actions.
• Mentor engineers and analysts through technical reviews, investigation feedback, and knowledge sharing while promoting sustainable engineering standards.
• Evaluate new security detection and response technologies, including AI-assisted capabilities, based on practical operational value, reliability, security, and measurable risk reduction.

Requirements

• Bachelor’s degree in cybersecurity, computer science, information technology, or equivalent professional experience.
• 5+ years of hands-on experience in security operations, incident response, threat detection, security engineering, or a closely related discipline, including ownership of complex investigations.
• Demonstrated experience building and tuning advanced detections in a SIEM, EDR/XDR, or cloud security analytics platform, with the ability to explain detection logic and validate underlying evidence.
• Strong understanding of attacker techniques, Windows and Linux internals, identity-based attacks, network protocols, cloud security, and incident response methodology.
• Hands-on experience integrating security platforms through APIs, developing orchestration workflows, and implementing automated investigation or response actions using SOAR tools and enterprise IT service management platforms.
• Familiarity with AI-assisted security investigation, agent-based automation, or LLM-enabled security workflows is a plus (specialized AI development or production AI-agent experience is not required).
• 3+ years of hands-on experience with the Microsoft Defender security suite (including Defender for Endpoint, Defender for Identity, Defender for Office 365, or Defender XDR) and related Microsoft security/identity technologies, including Entra ID.
• 3+ years of hands-on experience with enterprise security technologies such as Zscaler, CrowdStrike Falcon, Abnormal Security, Tines, Armis, and Splunk, or equivalent platforms (experience with every named product is not required).
• Proven ability to investigate incidents and engineer or tune detections directly in EDR/XDR, SIEM, network security, email security, and identity platforms, including querying telemetry, investigating alerts, and operationalizing response actions.
• Knowledge of MITRE ATT&CK, NIST incident response guidance, and security engineering best practices.
• Professional security certifications such as CISSP, GCIH, GCFA, GCDA, or equivalent preferred.
• Excellent written and verbal communication skills, cross-functional collaboration, and demonstrated ownership of technical initiatives.

Technologies

• MITRE ATT&CK
• SIEM, EDR/XDR
• Cloud security analytics platform
• Detection-as-code
• SOAR
• AI-assisted analysis, agent-based capabilities
• LLM-enabled security workflows
• Microsoft Defender for Endpoint, Microsoft Defender for Identity, Microsoft Defender for Office 365, Defender XDR
• Entra ID
• Zscaler, CrowdStrike Falcon, Abnormal Security, Tines, Armis, Splunk
• Windows internals, Linux internals
• NIST incident response guidance

Benefits

• Participation in a retirement plan
• Life and disability insurance
• Health, dental and vision plans
• Flexible spending accounts
• Sick leave
• Vacation time
• Personal time
• Parental leave
• Employee stock purchase plan

Location: Cockeysville, MD (onsite). Compensation: USD 111,000 - 147,805 per year.