Lead Cybersecurity Engineer - SIEM/AI

Description

The company provides trusted vehicle information used by people who build, sell, and own cars. It owns CARFAX, automotiveMastermind, Market Scan, and Polk Automotive Solutions.

The team is focused on changing how the automotive industry works, and the company is shaping that work with AI and its data.

The company has been recognised as a best place to work by several regional publications, including Virginia Business, Washingtonian, The Washington Post, and the St. Louis Post-Dispatch.

Responsibilities

• Drive the continued growth of the Google SecOps platform, widening detection coverage, improving data quality, and making the SIEM more effective overall.
• Build, tune, and run detection rules, parsers, data pipelines, and log integrations so the enterprise has reliable visibility.
• Work with Threat Intelligence and Cyber Defense to turn new threats into high-confidence detections that produce usable alerts.
• Review current Cyber Defense processes and find where AI and automation can make them leaner.
• Create AI-assisted tools, workflows, and custom agents that help analysts work faster, and improve the data and detections that feed AI-driven alert triage.
• Build integrations, automations, and enrichment that cut manual work, speed up investigations, and shorten response times.
• Set and track metrics such as detection effectiveness, false-positive reduction, automation uptake, and analyst productivity.
• Write clear documentation for detections, engineering work, workflows, and operating procedures so they stay maintainable.
• Work closely with Security Operations, Threat Intelligence, Incident Response, and Engineering to keep improving detection and response.

Requirements

• You have 6+ years of hands-on experience engineering and tuning enterprise SIEM platforms, including implementing and maturing Google SecOps or a comparable SIEM.
• You have deep Google SecOps skills across detection engineering, parser development, log onboarding, data normalisation, and platform administration, and a track record of improving SIEM results through wider coverage, tuning, and better data.
• You have applied AI and automation in security operations to areas such as alert triage, investigations, threat hunting, case management, or other Cyber Defense workflows, and can assess a process and build a fix that cuts manual effort.
• You are proficient in Python or a similar scripting language for integrations, automations, and workflow improvements.
• You understand detection engineering, attacker tactics and techniques, security telemetry, and the full security data lifecycle. You communicate clearly in writing and speaking and solve problems analytically.
• The role is hybrid. In-office expectations depend on your location and may change as business needs evolve.
• You must already be authorised to work in the United States and will not need employer sponsorship now or later.
• The expected annual base salary is $112,000 to $168,000. The exact figure depends on location, experience, skills, qualifications, and internal equity.
• The company pays competitively for local market conditions and individual contribution. Beyond base salary, you may be eligible for incentive pay, long-term incentives, and a full benefits package, where applicable.

Conditions

This is a hybrid role, with the in-office schedule set by your location and open to change.

Applicants must already be authorised to work in the United States, and no sponsorship will be provided now or in the future.

Base pay falls between $112,000 and $168,000 a year, adjusted for location, experience, skills, qualifications, and internal equity.

Benefits

• Competitive pay, including base salary and incentive opportunities where applicable.
• Health and wellness coverage for employees and eligible dependents.
• Retirement savings plans, with company matching contributions where available.