The posting
Job Description
We are looking for an experienced, technically driven security professional to advance Sinclair’s Information Security program. You will serve as a Senior Information Security Engineer focused on Security Operations, incident response, and advanced detection engineering. You will independently investigate complex threats, engineer high-fidelity detections across endpoint, identity, network, and cloud environments, and strengthen incident response through security tooling, workflow orchestration, and automation. You will also help evaluate and apply AI-assisted capabilities where they improve investigation quality and response efficiency. You will partner with internal teams, business stakeholders, and external security providers to improve detection coverage, accelerate response, and reduce enterprise risk.
Responsibilities:
Processes & Execution
- Lead technical investigation, triage, containment, eradication, and recovery activities for complex security incidents across on-premises, cloud, identity, and endpoint environments.
- Analyze security telemetry, authentication activity, process execution, network traffic, and threat intelligence to determine root cause, attack scope, impact, and appropriate response.
- Perform proactive threat hunting and retrospective investigations; identify gaps in telemetry, detections, and response capabilities.
- Own high-severity incident investigations, document evidence-based findings, communicate business impact, and coordinate timely remediation with system owners and external partners.
- Apply MITRE ATT&CK and other relevant threat-informed methodologies to improve investigation quality, detection coverage, and response effectiveness.
- Demonstrate independent technical judgment, clear communication, and accountability for outcomes in time-sensitive situations.
Engineering, Collaboration & Partnerships
- Design, develop, test, deploy, and continuously tune complex detection mechanisms for multi-stage attacks, identity compromise, lateral movement, persistence, exfiltration, and other advanced adversary behaviors.
- Correlate endpoint, SIEM, identity, email, network, and cloud telemetry to create behavioral, contextual, and risk-based detections rather than relying solely on static indicators.
- Develop and maintain detection-as-code content, queries, analytics, and validation tests; assess false positives, data quality, precision, and detection gaps.
- Design, implement, and maintain automated SecOps and incident response workflows using security platforms, APIs, SOAR technologies, and enterprise ticketing systems to streamline enrichment, investigation, containment, and remediation.
- Advance security operations automation by integrating AI-assisted analysis and agent-based capabilities, where appropriate, into existing investigation and response processes to improve context, prioritization, and analyst efficiency.
- Apply established security engineering controls to automated response workflows, including least-privilege access, action validation, approval for high-impact remediation, logging, exception handling, and escalation to analysts.
- Integrate third-party alert and investigation outputs with internal telemetry to support independent validation, deeper investigation, and consistent remediation.
- Collaborate with infrastructure, IAM, cloud, endpoint, IT operations, and external security partners to validate detections, remediate threats, and operationalize new capabilities.
Performance Improvement
- Measure and improve detection coverage, fidelity, mean time to detect/respond, investigation quality, automation success, and analyst effort saved.
- Continuously test detections and response workflows using attack simulations, adversary emulation, incident lessons learned, and controlled validation.
- Document engineering designs, investigation procedures, response decision criteria, automation safeguards, and operational runbooks.
- Identify repetitive analyst tasks suitable for automation while preserving human oversight for uncertain, destructive, or business-disruptive actions.
- Mentor engineers and analysts through technical reviews, investigation feedback, and knowledge sharing; promote sustainable engineering standards.
- Evaluate new security detection and response technologies, including AI-assisted capabilities, based on practical operational value, reliability, security, and measurable risk reduction.
Qualifications:
- Bachelor’s degree in cybersecurity, computer science, information technology, or equivalent professional experience.
- 5+ years of hands-on experience in security operations, incident response, threat detection, security engineering, or a closely related discipline, including ownership of complex investigations.
- Demonstrated experience building and tuning advanced detections in a SIEM, EDR/XDR, or cloud security analytics platform; ability to explain detection logic and validate underlying evidence.
- Strong understanding of attacker techniques, Windows and Linux internals, identity-based attacks, network protocols, cloud security, and incident response methodology.
- Hands-on experience integrating security platforms through APIs, developing orchestration workflows, and implementing automated investigation or response actions using SOAR tools and enterprise IT service management platforms.
- Familiarity with AI-assisted security investigation, agent-based automation, or LLM-enabled security workflows is a plus; specialized AI development or production AI-agent experience is not required.
- 3+ years of hands-on experience with the Microsoft Defender security suite (such as Defender for Endpoint, Defender for Identity, Defender for Office 365, or Defender XDR) and related Microsoft security/identity technologies, including Entra ID.
- 3+ years of hands-on experience with enterprise security technologies such as Zscaler, CrowdStrike Falcon, Abnormal Security, Tines, Armis, and Splunk, or equivalent platforms; strong experience across multiple tools is expected, but experience with every named product is not required.
- Proven ability to investigate incidents and engineer or tune detections directly in EDR/XDR, SIEM, network security, email security, and identity platforms, including querying telemetry, investigating alerts, and operationalizing response actions.
- Knowledge of MITRE ATT&CK, NIST incident response guidance, and security engineering best practices.
- Professional security certifications such as CISSP, GCIH, GCFA, GCDA, or equivalent preferred.
- Excellent written and verbal communication skills, cross-functional collaboration, and demonstrated ownership of technical initiatives.
Please note that this position is not eligible for visa sponsorship, including employer sponsorship for an H-1B visa, OPT-STEM employment, etc.
The base salary compensation range for this role is $111,000 to $147,805. Final compensation for this role will be determined by various factors such as a candidates’ relevant work experience, skills, certifications, and geographic location. Full time positions are eligible for benefits that include participation in a retirement plan, life and disability insurance, health, dental and vision plans, flexible spending accounts, sick leave, vacation time, personal time, parental leave and employee stock purchase plan.
Sinclair is proud to be an equal opportunity employer and a drug free workplace. Employment practices will not be influenced or affected by virtue of an applicant's or employee's race, color, religion, sex (including pregnancy, gender identity, and sexual orientation), national origin, age, disability, genetic information, military or veteran status or any other characteristic protected by law.
About Sinclair:
Sinclair, Inc. (Nasdaq: SBGI) is a diversified media company and a leading provider of local news and sports. The Company owns, operates and/or provides services to 177 television stations in 79 markets affiliated with all major broadcast networks; owns Tennis Channel, the premium destination for tennis enthusiasts; and multicast networks CHARGE, Comet, ROAR and The Nest. Sinclair’s AMP Media produces a growing portfolio of digital content and original podcasts. Additional information about Sinclair can be found at www.sbgi.net.
About the Team
The life-blood of our organization is our people. We have a compelling story, a goal-oriented culture, and we take really good care of people. How good? Here is a glimpse: great benefits, open-door policy, upward mobility and a strong desire to see you succeed. Ready to be part of a winning team? Let’s talk.
