{"id":3116665,"url":"https://alion.io/job/xboxgaming-expert-detection-and-response-engineer","title":"Expert Detection and Response Engineer","company":{"id":4431652,"name":"Xbox","domain":"xboxgaming.com","url":"https://alion.io/company/xboxgaming","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":{"grade":"B","score":75,"open_postings":7,"ghost_share":0,"stale_share":1,"repost_share":0,"time_to_fill_p50_days":null,"computed_at":"2026-10-26T05:57:25Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Irvine, United States","United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":124000,"max":229400,"currency":"USD","period":"year","gross":null,"usd_annual":229400},"salary_estimate":null,"experience_years_min":12,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"LLM","optional":false},{"name":"PowerShell","optional":false},{"name":"Python","optional":false},{"name":"SIEM","optional":false},{"name":"Active Directory","optional":true}],"status":"live","first_seen_at":"2026-10-14T00:00:00Z","employer_posted_date":"2026-10-14","last_verified_at":"2026-10-26T05:06:30Z","board_verified":true,"closed_at":null,"days_open":12,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":12},"description":"Job Title:\nExpert Detection and Response EngineerRequisition ID:\nR028213Job Description:\nRole Overview\nActivision is seeking an Expert Detection and Response Engineer to help protect our players, studios, platforms, and enterprise environments from advanced cyber threats. As part of our Global Security Operations organization, this role is responsible for actively identifying, investigating, and responding to security threats. This role is highly hands-on and focuses on real-world attacker behavior, rapid analysis, and effective containment.\nResponsibilities\nDetect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands-on member of the TDIR team.\nMonitor and analyze security telemetry and audit logs to identify anomalous activity, unauthorized access, and emerging threats, including targeted attacks and advanced adversaries.\nPerform alert triage, in-depth investigation, and forensic analysis across the full incident lifecycle, from identification through containment, remediation, and post-incident review.\nExecute endpoint, identity, cloud, and malware investigations, including timeline reconstruction, indicator extraction, and root cause analysis.\nDevelop, refine, and tune threat detections within the SIEM based on real-world attacker behavior and investigation findings.\nEnhance investigation and response efficiency through automation, SOAR workflows, scripting, and advanced analytics.\nDesign, build, or operate AI/LLM-assisted triage and enrichment workflows (e.g., agentic pipelines integrated with case management platforms) to accelerate investigation and reduce analyst toil.\nEvaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict-poisoning risks introduced via analyzed artifacts, applying schema-constrained or otherwise bounded output design rather than relying solely on input-side filtering.\nContribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics.\nCollaborate closely with engineering teams, business stakeholders, and vendors during active investigations and response efforts.\nParticipate in an on-call rotation and provide off-hours support for critical incidents and material security events.\nCommunicate investigation findings clearly and effectively to technical teams and leadership.\nOccasional travel (up to approximately 10%) may be required to support studios or on-site incident response.\nRequired Qualifications\nBachelor’s degree in computer science, Information Security, or equivalent practical experience. 10+ years of progressively accountable security experience, with a demonstrated track record of independent, expert-level judgment in incident response.\nHands-on experience in threat detection, security operations, and incident response, with active involvement across the full incident lifecycle.\nStrong understanding of the modern threat landscape, attacker tactics, techniques, and procedures.\nProven ability to detect, triage, investigate, and respond to security incidents in enterprise environments.\nExperience performing detailed log analysis, correlation, and investigative triage.\nStrong written and verbal communication skills, with the ability to clearly articulate incident findings and response actions.\nAbility to work independently and collaboratively within the TDIR team and with technical and business stakeholders.\nWillingness to participate in an on-call rotation and provide off-hours support for critical security incidents.\nHands-on experience with security monitoring platforms such as SIEM and EDR, including building or significantly extending detection content (not solely tuning existing rules).\nScripting or programming experience (e.g., Python, PowerShell, KQL) to support detection, investigation, or response automation.\nStrong host- and network-based forensic skills, including timeline reconstruction and root cause analysis.\nWorking knowledge of how LLMs are applied to security operations (alert enrichment, auto-triage, summarization) and the failure modes specific to that application, such as hallucinated verdicts, injection via log or artifact content, and over-trust in model output.\nFluency in English.\nPreferred Qualifications\n12+ years of relevant IT and security experience, including prior leadership or mentorship of less-senior analysts.\nHands-on malware analysis experience using static and dynamic techniques.\nExperience implementing or operating SOAR platforms and security automation.\nHands-on experience building or integrating AI-assisted triage into a SOC workflow (SOAR, case management, or custom pipeline), including designing constrained output schemas or guardrails rather than relying solely on vendor-side content filtering.\nFamiliarity with emerging threat models for AI-augmented security tooling, such as prompt injection and verdict poisoning via analyzed artifacts.\nIdentity-focused detection experience, including Active Directory, hybrid identity, and privileged account monitoring.\nUnderstanding foundational security best practices, including system and network hardening.\nAbility to assess incidents quickly, recommend effective response actions, and mitigate operational and reputational risk.\nExperience interfacing effectively with leadership, engineering teams, and external vendors.\nDemonstrated engagement with the cybersecurity community or strong evidence of self-driven learning and professional contribution.\nAt Activision, we strive to create the most iconic brands in gaming and entertainment. We’re driven by our mission to deliver unrivaled gaming experiences for the world to enjoy, together. We are home to some of the most beloved entertainment franchises including Call of Duty®, Crash Bandicoot™, Tony Hawk’s™ Pro Skater™, and Guitar Hero®. As a leading worldwide developer, publisher and distributor of interactive entertainment and products, our “press start” is simple: delight hundreds of millions of players around the world with innovative, fun, thrilling, and engaging entertainment experiences.\nWe’re not just looking back at our decades-long legacy; we’re forging ahead to keep advancing gameplay with some of the most popular titles and sophisticated technology in the world. We have bold ambitions to create the most inclusive company as we know our success comes from the passionate, creative, and diverse teams within our organization.\nWe’re in the business of delivering fun and unforgettable entertainment for our player community to enjoy. And our future opportunities have never been greater - this could be your opportunity to level up.\nReady to Activate Your Future?\nRewards\nWe provide a suite of benefits that promote physical, emotional and financial well-being for ‘Every World’ - we’ve got our employees covered! Subject to eligibility requirements, the Company offers comprehensive benefits including:\nMedical, dental, vision, health savings account or health reimbursement account, healthcare spending accounts, dependent care spending accounts, life and AD&D insurance, disability insurance;\n401(k) with Company match, tuition reimbursement, charitable donation matching;\nPaid holidays and vacation, paid sick time, floating holidays, compassion and bereavement leaves, parental leave;\nMental health & wellbeing programs, fitness programs, free and discounted games, and a variety of other voluntary benefit programs like supplemental life & disability, legal service, ID protection, rental insurance, and others;\nIf the Company requires that you move geographic locations for the job, then you may also be eligible for relocation assistance.\nEligibility to participate in these benefits may vary for part time and temporary full-time employees and interns with the Company. You can learn more by visiting https://www.benefitsforeveryworld.com/.\nIn the U.S., the standard base pay range for this role is $124,000.00 - $229,400.00 Annual. These values reflect the expected base pay range of new hires across all U.S. locations. Ultimately, your specific range and offer will be based on several factors, including relevant experience, performance, and work location. Your Talent Professional can share this role’s range details for your local geography during the hiring process. In addition to a competitive base pay, employees in this role may be eligible for incentive compensation. Incentive compensation is not guaranteed. While we strive to provide competitive offers to successful candidates, new hire compensation is negotiable.","description_format":"text","description_chars":8559,"description_truncated":false,"requirements":{"experience_years_min":12,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Parental leave","Relocation assistance"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":true,"industries":[],"lifecycle":[{"event":"open","at":"2026-10-22T22:16:02Z"}],"visa":[],"liveness":{"score":80,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.89,"p_room":0.9,"age_days":12,"expected_fill_days":29,"reasons":["conf:0","velocity","win:mid"],"computed_at":"2026-10-26T05:57:25Z"},"pay":{"stated_usd_annual":229400,"is_top_pay":true},"html_url":"https://alion.io/job/xboxgaming-expert-detection-and-response-engineer","json_url":"https://alion.io/job/xboxgaming-expert-detection-and-response-engineer.json","meta":{"generated_at":"2026-10-26T21:26:54Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":28936,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-27T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":4431652},"rest":"https://alion.io/mcp/rest/get_company?id=4431652"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fxboxgaming-expert-detection-and-response-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fxboxgaming-expert-detection-and-response-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fxboxgaming-expert-detection-and-response-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/xboxgaming-expert-detection-and-response-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fxboxgaming-expert-detection-and-response-engineer"}]}