Senior Cyber Security Engineer

Bread Financial is a tech-forward financial services company providing payment, lending, and saving solutions to U.S. consumers. The Senior Cyber Security Engineer designs, implements, and operates security capabilities across cyber engineering, IAM, and cyber defense while leading complex security operations. The role advances detection engineering, automated response, threat intelligence, AI-assisted SOC workflows, secure architecture, and incident response, while mentoring junior engineers.

Responsibilities:

• Design, implement, and operate security engineering solutions aligned to enterprise standards, architecture patterns, and risk management objectives including emerging cybersecurity and technology trends. - (25%)
• Lead analysis and response for complex security events and incidents, including investigation, containment, remediation, and post‑incident improvements. - (20%)
• Implement and evolve secure architecture patterns across cloud, identity, and cyber defense capabilities to support scalable and resilient environments. - (15%)
• Partner with Product and Technology teams to identify, assess, and mitigate security risks impacting products, platforms, and client‑facing systems. - (15%)
• Provide security input into product features, integrations, and release readiness activities to support secure delivery and ongoing operations. - (10%)
• Evaluate emerging threats, vulnerabilities, and technologies to inform security enhancements, tooling improvements, and engineering priorities. - (5%)
• Represent security engineering in cross‑functional design, architecture, and governance discussions to support informed technical decisions. - (5%)
• Mentor junior engineers and contribute to documentation, standards, and continuous improvement initiatives within the Cyber Security team. - (5%)

Requirements:

• Bachelor's Degree in Computer Science, Networking, Information Technology or related field of study or equivalent, relevant work experience
• 5-8 years of experience in cybersecurity, security operations (SOC), IAM, PAM, cyber defense, or a related technical role
• Demonstrated hands-on experience designing, implementing, and maintaining security solutions, including logging and monitoring, endpoint protection, vulnerability management, identity and access controls, and incident response capabilities and cloud environments
• 3 to 4 days per month are required in office if within 60 miles of a posted Bread Financial location
• Ability to travel up to 10% annually
• Communicate/Hearing
• Communicate/Talking
• Stationary Position/Seated
• Typing/Writing
• Maintain focus in high pressure or fast-paced work environment
• You must be work authorized in the United States on a full time basis without the need for any sponsorship now or in the future from any employer or organization. The Company cannot offer employment to F-1 (student) visa holders
• Master's Degree in Computer Science, Networking or Information Technology or related field of study or equivalent, relevant work experience
• Possession of industry-recognized certifications such as CISSP, CISM, CCSP, and/or cloud security certifications (e.g., AWS Certified Security)
• 8-10 years of experience in cybersecurity, security operations (SOC), IAM, PAM, cyber defense, or a related technical role
• Hands-on experience building and maintaining detections in one or more SIEM platforms (Splunk, CrowdStrike Next-Gen SIEM, Palo Alto XSIAM)
• Proven experience onboarding and normalizing logs across endpoint, identity, cloud, network, and application sources
• Experience managing detections using Git-based workflows, code review, branching strategies, and CI/CD principles
• Familiarity with testing frameworks for detections (unit testing logic, regression testing, synthetic event generation, and controlled replay)
• 3+ years designing and implementing SOAR playbooks and response automations (Cortex XSOAR, Splunk SOAR)
• Demonstrated success reducing mean time to detect and respond through automation and orchestration
• Experience translating intelligence into practical outcomes such as detections, hunts, enrichment, and response actions
• Familiarity with TI platforms and standards (MISP, OpenCTI, STIX/TAXII) and integrating TI into SIEM and SOAR workflows
• Strong experience mapping detections and response playbooks to MITRE ATT&CK
• Experience building behavior-based detections that reduce reliance on static indicators
• Experience applying AI to detection engineering or SOC operations such as alert summarization, triage enrichment, incident clustering, case routing, and knowledge retrieval
• Experience designing guardrails for AI usage: human-in-the-loop approvals, audit logging, data handling controls, and prompt or workflow governance
• Writing high-signal detections using SPL, KQL, EQL, Lucene, Sigma, or equivalent query languages
• Behavior-based detection design, including correlation, baselining, anomaly, and sequence detection
• Alert tuning, suppression, allowlisting, and noise reduction
• Data modeling, normalization, field extraction, parsing, and enrichment strategies
• Detection coverage mapping to MITRE ATT&CK and kill chain concepts
• Building SOAR playbooks and automated response actions with approval gates and safe failure modes
• Integrations via REST APIs, webhooks, message queues, and event-driven designs
• Case management, ticketing integration, and automated evidence collection
• Automated containment actions: disable accounts, revoke sessions, isolate endpoints, block indicators, quarantine email, update firewall rules
• Converting TI into actionable detections, hunts, enrichment, and prioritized response steps
• IOC lifecycle management, confidence scoring, and expiration handling
• Familiarity with STIX/TAXII, MISP, OpenCTI, and TI feeds
• Threat hunting methodologies, hypothesis-driven hunting, and translating hunts into detections
• Designing AI-assisted workflows for triage, summarization, correlation, and recommendation
• Building agentic workflows with human approvals, audit trails, and policy guardrails
• Prompt engineering fundamentals for security workflows and retrieval-augmented approaches
• Evaluating AI outputs for accuracy, bias, and safety, including fallback procedures
• SIEM administration fundamentals and search performance optimization
• Endpoint telemetry and EDR concepts: process trees, persistence, lateral movement, and malware tradecraft
• Identity telemetry: authentication events, conditional access, privilege changes, and OAuth abuse
• Cloud telemetry: audit logs, IAM events, workload signals, and network flow logs
• Scripting and automation using Python and PowerShell
• Infrastructure as code concepts and configuration management practices
• Git, version control, code review, and CI/CD for detection and automation content
• Documentation practices for runbooks, playbooks, and detection intent and testing
• Incident handling and escalation judgment
• Writing clear, analyst-friendly detection documentation and response instructions
• Operational maturity mindset: continuous improvement, post-incident reviews, and backlog prioritization
• Cross-functional collaboration and influencing without authority