Sr Detection and Response Engineer, Information Security
CommScope · Charlotte
In our ‘always on’ world, we believe it’s essential to have a genuine connection with the work you do.
Sr Detection and Response Engineer, Information Security
Job Number: 82746
Reports To: Manager, Security Operations
FLSA Status: Exempt
General Summary
CommScope is seeking a Senior Detection and Response Engineer to serve as a L3 technical lead and escalation point in our Security Operations Center. This is a hands-on engineering role. You will own complex investigations and incident response end to end, and build the detections, automations, and AI-assisted workflows that let a lean team operate at scale.
You will work closely with our MDR partner and junior analysts, turning lessons learned from incidents into durable detection and response capability across a global IT and manufacturing (OT) environment. You will be expected to reduce manual effort, improve signal quality, and measurably shorten time to detect and respond.
CommScope’s security team protects the people, processes, and technologies that serve our customers, and their customers: the billions of people our products and services help connect every day.
Duties & Responsibilities
Incident Response and Escalation
- Serve as the L3 escalation point for alerts and incidents from L1/L2 analysts and our MDR provider. Lead investigations through containment, eradication, and recovery.
- Act as technical incident lead for high-severity events. Coordinate with IT, infrastructure, OT, and business stakeholders, and produce clear executive and technical incident reports.
- Perform host, network, identity, email, and cloud forensics, including log analysis, memory and disk triage, and malware behavior analysis.
Detection Engineering
- Design, build, test, and tune detections in the SIEM and EDR (Microsoft Sentinel, CrowdStrike NG-SIEM) using KQL and related query languages. Map coverage to MITRE ATT&CK and CommScope’s top enterprise and OT threat scenarios.
- Own the detection lifecycle, including false-positive reduction, coverage gap analysis, and detection-as-code practices with version control and peer review.
- Engineer log pipelines and data quality with Cribl, so the telemetry needed for detection and investigation is complete, normalized, and cost-effective.
Automation and AI
- Build and maintain SOAR playbooks and automations for enrichment, triage, case creation, containment, and closure. Target measurable reductions in analyst hours and MTTR.
- Design, test, and operationalize AI-assisted SOC workflows, such as Copilot agents, LLM-based triage and summarization, and guided playbook agents. Apply appropriate guardrails: least privilege, human approval for destructive actions, prompt-injection resilience, and output validation.
- Integrate security tooling through APIs and scripting (Python, PowerShell) to remove manual, repetitive work.
Threat Hunting and Intelligence
- Conduct hypothesis-driven threat hunts informed by current threat intelligence and actor TTPs, and convert findings into new detections.
- Assess emerging vulnerabilities and threats for CommScope exposure, and recommend prioritized response actions.
Program and Team
- Develop and maintain SOC runbooks, escalation procedures, and tabletop exercises.
- Mentor L1/L2 analysts through case reviews, query and playbook coaching, and knowledge transfer.
- Report on SOC effectiveness metrics, including MTTD, MTTR, detection coverage, automation rate, and analyst hours saved.
- Participate in the on-call rotation (PagerDuty) as the senior escalation tier.
Accountability / Impact
Global CommScope footprint
Competencies
Manages Complexity: Makes sense of complex, high-volume, and sometimes contradictory security data to find root causes and resolve incidents.
Decision Quality: Makes sound, timely containment and response decisions based on analysis, experience, and judgment, and serves as a trusted source of technical advice.
Optimizes Work Processes: Continuously improves SOC workflows, automating manual and repetitive tasks to increase speed, consistency, and efficiency.
Tech Savvy: Anticipates the impact of emerging technologies, including AI, and adopts tools that deliver real value.
Action Oriented: Acts with urgency and decisiveness in fast-changing, unpredictable situations, and steps up to manage tough issues.
Being Resilient: Stays composed and effective under pressure, rebounding from setbacks while keeping incident response on track.
Communicates Effectively: Delivers clear, timely communication tailored to the audience, from technical incident details to executive summaries.
Required Qualifications for Consideration
- Bachelor’s in related curriculum such as
- Information Security, Computer Science, or related field (or equivalent experience)
- 6+ Years of Related Experience
Skills Required
Include demonstrated competencies and physical, mental, & interpersonal skills.
- 6+ years in information security, including 3+ years in a SOC, incident response, or detection engineering role at L2/L3 or equivalent. Bachelor’s degree in a related field or equivalent professional experience.
- Proven experience leading investigations and response for significant security incidents in an enterprise environment.
- Advanced proficiency with SIEM and EDR platforms (Microsoft Sentinel and CrowdStrike NG-SIEM preferred), including authoring and tuning detections in KQL or similar.
- Hands-on experience building SOAR playbooks and automations. Scripting proficiency in Python and/or PowerShell, plus REST API integration.
- Practical experience applying AI or LLM tools to security operations (triage, enrichment, summarization, query generation), with a clear understanding of their risks and limits.
- Strong working knowledge of Windows, Linux, and macOS internals, Active Directory and Entra ID, email security, network protocols, and cloud (Azure/M365) attack surfaces.
- Working knowledge of MITRE ATT&CK, the NIST incident response lifecycle, and the cyber kill chain.
- Clear written and verbal communication, including incident reports for both technical and executive audiences.
- Self-directed, with sound judgment under pressure and the ability to prioritize across competing incidents and engineering work.
- DESIRED – Certifications such as GCIH, GCFA, GCIA, GDAT, OSCP, or CrowdStrike/Microsoft security certifications.
- DESIRED – Experience with OT/ICS security monitoring in manufacturing environments.
- DESIRED – Experience with log pipeline tooling (Cribl), detection-as-code, and Git-based workflows.
- DESIRED – Experience working with an MDR provider.
Interview Exercises
- A live investigation exercise using a sample alert or log set, ending with a short written summary.
- A detection or automation design walkthrough. For example: write a KQL detection and describe how you would automate the response, including AI use and guardrails.
Why CommScope:
- CommScope is on a quest to deliver connectivity that empowers how we live, work, and learn. Our employees push the boundaries of communications technology that enables game-changing discoveries like 5G, the Internet of Things, and gigabit speeds for everyone, everywhere. With our unmatched expertise in copper, fiber, and wireless infrastructure, our global clients rely on us to outperform today and be ready for the needs of tomorrow.
- If you want to grow your career alongside bright, passionate, and caring people who strive to create what's next…..come connect to your future at CommScope.
- CommScope is an Equal Opportunity Employer (EEO), including people with disabilities and veterans. If you are seeking an accommodation for the application or interview process, please contact us to submit your request at talentacquisition@commscope.com. You can also learn more about CommScope’s accommodation process and EEO policy at https://jobs.commscope.com/eeo
; ;