Information Security Engineer, I at Zebra… · Lincolnsh…

Summary: Zebra Technologies is a community of innovators dedicated to creating smart solutions for their customers. They are seeking an Information Security Engineer, I to integrate advanced AI capabilities within their Security Operations Center, focusing on enhancing threat detection, incident response, and vulnerability management through AI-driven solutions. Responsibilities: - Design, build, and deploy agentic AI frameworks to accelerate the full incident response lifecycle, from initial detection and triage to containment and eradication - Develop and refine sophisticated SOAR (Security Orchestration, Automation, and Response) playbooks that leverage AI prompts for dynamic, context-aware decision-making and automated remediation actions - Integrate AI agents into existing security platforms (SIEM, EDR, XDR) to provide real-time analysis of security events, automated evidence gathering, and recommended response actions for SOC analysts - Create and manage AI-powered systems to proactively hunt for threats by analyzing vast datasets for anomalous patterns, novel attack techniques, and indicators of compromise (IOCs) that evade traditional detection methods - Develop AI models and prompts to automate the collection, correlation, and analysis of threat intelligence from multiple sources, providing actionable insights tailored to our threat landscape - Build AI agents capable of contextualizing threat intelligence, predicting potential attack vectors, and recommending proactive defensive adjustments - Implement AI-driven workflows to automate the identification, prioritization, and remediation of vulnerabilities across the enterprise - Utilize AI to analyze vulnerability data in conjunction with threat intelligence and asset criticality, creating a dynamic, risk-based prioritization model - Develop SOAR rules and AI prompts to orchestrate mitigation efforts, reducing the mean time to remediate (MTTR) - Act as the subject matter expert for integrating generative and agentic AI into the SOC's toolset and daily operations - Collaborate with security analysts to identify and develop custom AI-powered tools and automations that address specific operational challenges and reduce manual effort - Continuously evaluate and experiment with emerging AI technologies and security platforms to ensure our SOC remains at the cutting edge of security innovation Required Qualifications: - Bachelor's Degree required or equivalent experience - 0-2 years of experience - Proven experience in a 24/7 SOC environment with hands-on responsibilities in incident response, threat hunting, or threat intelligence - Strong practical experience with SOAR platforms (e.g., Palo Alto XSOAR, Splunk SOAR, Microsoft Sentinel) and developing complex automation playbooks - Demonstrated ability to write and utilize scripts (e.g., Python) for security automation and integration - Deep understanding of existing security platforms such as SIEM, EDR, and threat intelligence platforms - Familiarity with the concepts of AI in cybersecurity, including crafting effective prompts for security use cases and understanding the principles of agentic AI workflows Preferred Qualifications: - Hands-on experience integrating AI, particularly large language models (LLMs), into security tools and workflows - Direct experience with AI-native security platforms like Microsoft Security Copilot - Knowledge of API integration for connecting disparate security systems and data sources - A strong understanding of threat actor methodologies (TTPs) and the MITRE ATT&CK framework - Certifications related to security operations, automation, or cloud security (e.g., GCIH, GCIA, GDAT) - Good verbal and written communication Skills - Ability to understand end user issues - Technical hands-on experience - Able to work independently and excel in a collaborative environment - Ability to trouble shoot - Demonstrated knowledge of applicable IT systems/applications - Ability to develop new systems and tools - Demonstrated analytical skills - Comfortable performing in a fast-paced, high growth, rapidly changing environment - Ability to identify and implement process improvements Required Skills: Security Operations Center (SOC) experience, Incident Response, Threat Hunting, Threat Intelligence, SOAR platforms, Security Orchestration, Automation, Response (SOAR) playbook development, Python scripting, Security Information, Event Management (SIEM), Endpoint Detection, Response (EDR), Agentic AI workflows, AI in cybersecurity, Large Language Models (LLMs) integration, API integration, MITRE ATT&CK framework, Analytical skills, Troubleshooting Benefits: Healthcare, Wellness, Inclusion networks, Continued learning and development offerings, Community service days, Traditional insurances, Compensation, Parental leave, Employee assistance program, Paid time off offerings, Flexibility for our teams including: hybrid work, adaptable hours, Summer Flex Fridays, Focus Fridays, and an annual companywide well-being day to promote revitalization and success