Security Operations Engineer

Segment: Global Cybersecurity Operations Reports To: Global Cybersecurity Operations Manager The Security Operations Engineer is responsible for engineering, operating, and continuously improving the organization's security operations capabilities, with a primary focus on incident response, detection engineering, security automation, email security, and AI-enabled security operations. This role serves as a technical escalation point for complex cybersecurity incidents while identifying and engineering opportunities to make security operations more effective, automated, scalable, and resilient. The Security Operations Engineer is expected to bring a strong engineering and innovation mindset: challenging existing processes, identifying inefficiencies, thinking beyond established approaches, evaluating emerging technologies, and turning successful ideas into sustainable security capabilities. The role works closely with the AI & Data Security Engineer and Azure Security Engineer to safely introduce and operationalize AI-enabled security capabilities. Responsibilities Incident Response & Investigation
• Serve as a primary technical escalation point for complex cybersecurity incidents.
• Investigate security incidents across identity, endpoint, email, cloud, network, and SaaS environments.
• Lead technical investigation, containment, eradication, and recovery activities.
• Perform root-cause analysis and identify opportunities to prevent recurrence.
• Conduct compromise assessments and technical threat investigations.
• Improve incident-response playbooks, procedures, and investigative workflows.
• Translate lessons learned from incidents into improved detections, controls, and processes. Detection Engineering & Optimization
• Design, develop, tune, and continuously improve security detections and alerts.
• Identify false positives, false negatives, detection gaps, and opportunities to improve coverage.
• Develop detection logic based on threat intelligence, incident findings, attacker behavior, and emerging techniques.
• Develop advanced security queries and investigative methods.
• Translate investigations and threat intelligence into new or improved detections.
• Engineer improvements that increase detection fidelity while reducing unnecessary operational workload.
• Identify opportunities to automate detection development, enrichment, investigation, and response. AI-Enabled Security Operations
• Engineer and continuously improve AI-enabled security operations capabilities.
• Identify opportunities to use AI agents for investigation, threat intelligence, detection engineering, alert triage, and incident response.
• Work closely with the AI & Data Security Engineer to evaluate, implement, validate, and operationalize AI-enabled security capabilities.
• Configure and optimize AI-assisted security workflows and agents for operational use.
• Validate AI-generated findings, recommendations, detections, and response actions before production use.
• Evaluate the accuracy, effectiveness, limitations, and operational value of AI-generated security outputs.
• Establish appropriate human-review and escalation requirements for AI-assisted security operations.
• Convert successful AI proofs of concept into reliable, documented, and maintainable operational capabilities. Security Automation & Innovation
• Identify manual, repetitive, inefficient, or error-prone security processes and engineer opportunities for improvement.
• Develop automation, integrations, scripts, and workflows that improve investigation, response, detection, and operational efficiency.
• Continuously evaluate emerging cybersecurity technologies and their applicability to the organization.
• Participate in technical proofs of concept and objectively evaluate their results.
• Challenge existing processes and assumptions when a more effective approach is possible.
• Design solutions with scalability, maintainability, reliability, and security in mind.
• Continuously look for opportunities to move security operations from reactive processes toward proactive, engineered capabilities. Managed Security Service Provider Oversight
• Serve as the technical security operations counterpart to managed security service providers.
• Review and validate escalated incidents and investigations.
• Evaluate alert quality, investigation effectiveness, and operational performance.
• Identify recurring false positives, missed detections, and process gaps.
• Work with service providers to tune detections, improve escalation criteria, and optimize operational processes.
• Challenge and validate recommendations where appropriate.
• Identify opportunities to improve capabilities through engineering, automation, or internal ownership. Email & Identity Security Operations
• Own the technical security operations of the organization's email-security capabilities.
• Investigate phishing, malicious email, impersonation, business email compromise, malicious attachments, malicious URLs, and compromised accounts.
• Develop and tune email-security detections and policies.
• Support phishing investigations, simulations, and security-awareness initiatives.
• Investigate suspicious authentication, account compromise, privilege abuse, and anomalous identity activity.
• Support improvements to authentication and access-control policies based on operational findings.
• Partner with cybersecurity and architecture teams on identity-security improvements. Security Operations Collaboration
• Partner with the AI & Data Security Engineer on AI-enabled security operations and emerging technologies.
• Collaborate with the Azure Security Engineer on cloud and identity investigations.
• Engage the Azure Security Architect when operational findings identify architectural requirements or systemic security gaps.
• Collaborate with the Connectivity Security Engineer on network-related investigations and security improvements.
• Cross-train with other Cybersecurity Operations specialists and contribute to shared operational knowledge. Qualifications Required Qualifications
• Strong hands-on experience in incident response and security investigations.
• Experience investigating identity, endpoint, email, cloud, network, and SaaS security events.
• Experience developing, tuning, or engineering security detections and alerts.
• Experience with SIEM, XDR, EDR, email-security, or security-monitoring technologies.
• Experience with threat intelligence, investigation, and IOC analysis.
• Strong understanding of attacker behavior and common attack techniques.
• Experience developing security automation, scripts, integrations, or workflows.
• Strong analytical, critical-thinking, troubleshooting, and problem-solving skills.
• Demonstrated ability to identify opportunities for improvement rather than simply following established processes. Preferred Qualifications
• Microsoft Security Operations certification or equivalent experience.
• Experience with SIEM, XDR, EDR, SOAR, or security orchestration technologies.
• Experience with AI-assisted security operations or AI agents.
• Experience evaluating or validating AI-generated security analysis.
• Digital forensics or malware-analysis experience.
• Threat intelligence experience.
• Security automation and scripting experience.
• Experience with email authentication and security technologies.
• Experience designing or participating in security proofs of concept.
• Experience working with an MSSP or external security provider. Duracell is the world’s leading manufacturer and marketer of high-performance alkaline batteries, complemented by a portfolio of high quality, market leading specialty, rechargeable and professional batteries. Duracell’s products power numerous critical professional devices across the globe such as heart rate monitors, defibrillators, telemetry devices, smoke detectors, fire alarms, automated valves and security systems. As the leader in the professional power category, Duracell has a rich history of innovation, continuously introducing batteries that are smaller, thinner, with more energy and longer lasting than competitive brands. Since March 2016, Duracell has found its permanent home within Berkshire Hathaway (ranked #4 World's Most Admired Companies by Fortune Magazine and #3 in the Fortune 500), and will continue to focus on sustainable growth, industry-leading innovation while creating long-term value for our customers and consumers. At Duracell, integrity, end-to-end accountability across all levels, fast decision-making and a “can do” attitude is highly valued.