{"id":1511566,"url":"https://alion.io/job/ryder-system-security-operations-threat-hunting-engineer","title":"Security Operations & Threat Hunting Engineer","company":{"id":8229,"name":"Ryder System","domain":"ryder.com","url":"https://alion.io/company/ryder-system","size_band":"5000+","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"A","score":88,"open_postings":48,"ghost_share":0,"stale_share":0.667,"repost_share":0,"time_to_fill_p50_days":20,"computed_at":"2026-10-17T05:46:00Z"}},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Coral Gables, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":110000,"max":null,"currency":"USD","period":"year","gross":null,"usd_annual":110000},"salary_estimate":null,"experience_years_min":4,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Active Directory","optional":false},{"name":"Bash","optional":false},{"name":"Cyber Kill Chain","optional":false},{"name":"DHCP","optional":false},{"name":"DLP","optional":false},{"name":"DNS","optional":false},{"name":"Linux","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"SLI/SLO/SLA","optional":false},{"name":"Telegram","optional":false},{"name":"Unix","optional":false},{"name":"WhatsApp","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-09-29T00:00:00Z","employer_posted_date":"2026-09-29","last_verified_at":"2026-10-17T20:37:37Z","board_verified":true,"closed_at":null,"days_open":19,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":19},"description":"Job Seekers can review the Job Applicant Privacy Policy by clicking here.\nJob Description:\nSummary\nThe Security Operations Center (SOC) EngineerRole is designed to provide senior level leadership for the design, engineering, and implementation of the security event data collection for the Enterprise Information Security organization related to incident response, threat monitoring, threat intelligence, and operations across SIEM platforms.This Role will be engaged in work related todata identification, assessment, ingestion, normalizationand enrichment activities required for Ryder’s Security Operations Center to perform proper detection and analytics of cyber threats and response.The role alsoprovides proactive and preventive analysis of systems through product-specific SIEM tools and ancillary solutions used in security. The role also ensures SIEM solutions aid in the output of metrics to senior management to help maintaina safe and secure enterprise technical operation. Daily, the engineer ensures SIEM solutions are healthy, maintainingintegrity and performing optimally, and that capacitykeeps up with demandas well as managing and optimizingsecurity infrastructure, including robust monitoring, effective alerting, automation, comprehensive reporting, and hands-on system administration.To be successful, a solid understanding of and practical hands-on experience with security principles, host configurationsand networking is required.\nEssential Functions\nServe as the SOC engineer for SIEM design, related components, and the confidentiality, integrity, and availability (CIA) of logs.\nImplement and manage automated alerting systems to ensure timely detection and response to potential security incidents, enabling proactive mitigation efforts.\nOversee the management and maintenance of security systems, ensuring proper configuration, regular updates, and seamless integration into the organization's broader security infrastructure. This includes the continual evaluation of system performance and effectiveness.\nMaintain and manage a variety of security tools and hardware, ensuring their optimal performance, availability, and configuration. This includes routine hardware upkeep, troubleshooting technical issues, and software updates to align with industry standards and emerging technological advancements.\nIntegrate threat intelligence into operational frameworks to enhance detection capabilities. This involves analyzing external intelligence sources, correlating them with internal data, and adapting defense strategies based on insights.\nLead and perform the content development within the SIEM platform which includes use case creation, dashboard design, tuning of use cases to minimize false positives, development of reporting metrics such as SLA and KPI reports and Log source configuration.\nLeverage SOAR (Security Orchestration, Automation, and Response) technologies to streamline and automate incident response workflows, reducing reaction times and improving operational efficiency.\nReview and enhance logging information flow strategies and technical information flow required for log onboarding; create the work plan required for logging onboarding to include determining the technical details.\nHelp correlate events to support SOC response requirements.\nAdditional Responsibilities\nBe readily available for incident response, forensic, troubleshooting and security issues requiring event details.\nSupport SOC automation initiatives leveraging playbooks, while also using human analysis as needed.\nActively engage in security projects across the business to implement event and logging requirements.\nActively participate in threat hunting tabletop exercises to hone and strengthen skills across the team.\nMaintain up-to-date level of knowledge related to security threats, vulnerabilities and mitigations set forth to reduce attack surface.\nOpenly support the CISO, management team and executive leadership, even during tumultuous times.\nSupport SOC Analyst Tier 1-3\nAct as an escalation point for the security Analysts to assist and advise on the most complex security threat investigations.\nLeverage advanced knowledge of security operations, cyber security tools, intrusion detection, and secured networks to integrate with eh SIEM platform.\nPerform other duties as assigned.\nSkills and Abilities\n Strong communication skills, enabling effective collaboration across various departments and clear articulation of findings and recommendations., Required\n Ability to analyze event and incident logs and work with SOC and IR teams to assess security events related to malware, vulnerabilities, exploits and kill chain methodology., Required\n Ability to interface with threat intelligence platforms and SOAR solutions to centralize and manage incidents and remediation workflow., Required\n Excellent organizational and time-management skills to navigate and prioritize multiple security tasks simultaneously while maintaining focus on key objectives., Required\n Ability to liaison to conduct tabletop exercises for security incidents and events., Required\n Ability to grasp and assess “big picture” issues and bring them to light to foster positive change for a more robust data ingestion platform and process., Required\n Strong project management, multitasking and organizational skills., Required\n Capable of working with diverse teams and promoting a positive enterprise-wide security culture, Required\n Highly organized, efficient, self-starter requiring minimal supervision., Required\nQualifications\nBachelor's Degree in Computer Science or 4+ years as a Cyber Security/SOC Engineer, Required\n4 years or more in Cybersecurity or information technology practitioner experience., Required\n4 years or more in Experience configuring Log data collection, enrichment, deployment, integration and deployment., Preferred\n4 years or more in Experience operating in a Security Operations Center (SOC) and incident response environment., Preferred\nKnowledgeable of and hands-on experience with supporting intrusion detection/prevention systems (IDS/IPS), firewalls, endpoint solutions, data loss prevention (DLP), Active Directory (AD) and application security. Intermediate, Required\nAdvanced knowledge of operating system configuration (Windows, Unix, Linux) and networking (DNS, DHCP, routing protocols). Intermediate, Required\nStrong understanding of key performance indicators (KPIs) and service-level agreements (SLAs) attributed to security and business objectives for key stakeholders. Advanced, Required\nExperienced with one or more scripting languages (e.g., Python, PowerShell, Bash, etc.). Intermediate, Preferred\nExperience preparing and delivering presentations to peers or senior executives. Intermediate, Required\n & Information Risk, Privacy, or Security Certification (CISSP, CCSK, CCSP, PCSM), Required, 1 Year\nTravel\nYes, 0-10%\nJob Category\nInformation SecurityOur Culture & Commitment:\nAt Ryder, you’re trusted to make an impact-while enjoying room to grow and having a voice that’s heard. Our culture is built on respect, collaboration, and shared pride in doing great work rooted in innovation and safety.\nYour Voice. Your Success. The Future We Build Together.\nCompensation Information:\nThe compensation offered to acandidate may be influenced by a variety of factors, including the candidate’s relevant experience; education, including relevant degrees or certifications; work location; market data/ranges; internal equity; internal salary ranges; etc. The position may also be eligible to receive an annual bonus, commission, and/or long-term incentive plan based on the level and/or type. Compensation rangesfor the position are below:\nPay Type:\nSalariedMinimum Pay Range:\n$110,000.00Maximum Pay Range:\n$115,000.00Benefits Information:\nFor all Full-time positions only: Ryder offers comprehensive health and welfare benefits, to include medical, prescription, dental, vision, life insurance and disability insurance options, as well as paid time off for vacation, illness, bereavement, family and parental leave, and a tax-advantaged 401(k) retirement savings plan.\nRyder is proud to be an Equal Opportunity Employer and Drug Free workplace.\nAll qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, sex, sexual orientation, gender identity, age, status as a protected veteran, among other things, or status as a qualified individual with disability.\nImportant Note:\nSome positions require additional screening that may include employment and education verification; motor vehicle records check and a road test; and/or badging or background requirements of the customer to which you are assigned.\nSecurity Notice for Applicants:\nRyder will only communicate with an applicant directly from a [@ryder.com] email address and will never conduct an interview online through a chat type forum, messaging app (such as WhatsApp or Telegram), or via an online questionnaire. During an interview, Ryder will never ask for any form of payment or banking details and will never solicit personal information outside of the formal submitted application through www.ryder.com/careers.\nShould you have any questions regarding the application process or to verify the legitimacy of an interview or Ryder representative, please contact Ryder at  or 800-793-3754.\nCurrent Employees:\nIf you are a current employee at Ryder, please click here to log in to Workday to apply using the internal application process.\nJob Seekers can review the Job Applicant Privacy Policy by clicking here.","description_format":"text","description_chars":9615,"description_truncated":false,"requirements":{"experience_years_min":4,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Equity","Life insurance","Parental leave","Retirement plans"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Threat Intelligence","Incident Response","Commerce","Logistics"],"lifecycle":[{"event":"open","at":"2026-09-30T08:09:44Z"}],"visa":[{"country":"US","licensed_sponsor":true,"evidence":"H-1B filings in 12 months: 57 · green card filings: 18","filings_12m":57,"filings_prev_12m":54,"green_card_filings_12m":18,"median_offered_wage_usd":121567,"route":null,"cap_exempt":false,"checked_at":"2026-10-15T11:24:14+00:00","sources":["US Department of Labor: LCA disclosure data (H-1B, H-1B1, E-3)","US Department of Labor: PERM disclosure data (green cards)"],"filings_for_role_12m":1}],"liveness":{"score":38,"band":"fade","label":"Fading","p_open":1,"p_active":0.501,"p_room":0.75,"age_days":18,"expected_fill_days":20,"reasons":["conf:2","stale_co","velocity","win:late","comp:brand"],"computed_at":"2026-10-17T05:46:00Z"},"pay":{"stated_usd_annual":110000,"is_top_pay":false},"html_url":"https://alion.io/job/ryder-system-security-operations-threat-hunting-engineer","json_url":"https://alion.io/job/ryder-system-security-operations-threat-hunting-engineer.json","meta":{"generated_at":"2026-10-18T03:21:57Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":5296,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-19T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":8229},"rest":"https://alion.io/mcp/rest/get_company?id=8229"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fryder-system-security-operations-threat-hunting-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fryder-system-security-operations-threat-hunting-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fryder-system-security-operations-threat-hunting-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ryder-system-security-operations-threat-hunting-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fryder-system-security-operations-threat-hunting-engineer"}]}