Security Operations Engineer

Requirements:

• Bachelors degree in computer science, information systems, cybersecurity, or a related field, or equivalent practical experience. Required degrees must be from an institution accredited by the Council for Higher Education Accreditation or an equivalent body.
• At least two years of experience in cybersecurity engineering, security operations, incident response, or a related technical field.
• Experience triaging cybersecurity alerts or incidents and supporting approved containment actions.
• Hands-on experience with enterprise security platforms in at least two areas, such as SIEM, EDR, secure web access, WAF, automation, or detection engineering.
• Experience with a scripting or automation language, APIs, webhooks, or structured configuration files.
• Experience with version control and Infrastructure as Code concepts.
• Working knowledge of cloud services and cloud security logs.
• Understanding of secure authentication, credential handling, and least-privilege access.
• Knowledge of incident response, common attacker techniques, and established cybersecurity frameworks.
• Ability to troubleshoot across technologies and create clear technical documentation.
• Must live in, or be willing to relocate to, the greater Southfield, Michigan area; greater Bellevue, Washington area; or San Francisco Bay Area, California.
• Preferred: Experience investigating public-cloud incidents and using cloud logs to establish scope.
• Preferred: Experience with security orchestration, incident-response automation, telemetry onboarding, or detection engineering.
• Preferred: Experience with secure web access or web application protection.
• Preferred: Experience creating reusable Infrastructure as Code modules.
• Preferred: Experience with AI-assisted development, agent-based workflows, or containerized automation.
• Preferred: Relevant cybersecurity, security operations, cloud fundamentals, or automation certifications.
• Preferred: Familiarity with Credit Acceptances business model, operations, and terminology.
• Knowledge of cyber threats, vulnerabilities, and common attack methods.
• Ability to connect security telemetry to investigative needs and turn response requirements into maintainable automation.
• Sound judgment in incident triage, containment, and escalation; critical thinking, attention to detail, and willingness to learn unfamiliar technologies.
• Ability to manage competing priorities, work independently, communicate clearly in writing and verbally, collaborate across teams, share knowledge, and escalate risk appropriately.

Responsibilities:

• Operate, maintain, and improve enterprise Cyber Defense platforms across endpoint, web, network, monitoring, and automation services.
• Maintain next-generation SIEM integrations; onboard telemetry and resolve ingestion, parsing, and data-quality issues.
• Maintain endpoint detection and response capabilities, support investigations, and carry out approved containment actions.
• Manage secure web access policies, inspection controls, and approved exceptions; troubleshoot access and performance issues.
• Support web application protections with network and application teams, including rules, logging, integrations, and approved exceptions.
• Triage cybersecurity alerts and incidents, gather evidence, document findings, determine scope, and escalate as appropriate.
• Support approved containment, remediation, and recovery across enterprise and cloud environments.
• Develop and refine detection logic to improve signal quality and investigative value.
• Build response playbooks and automate repeatable investigation and response tasks using scripting, APIs, and webhooks.
• Maintain approved Cyber Defense resources using Infrastructure as Code, version control, testing, and change-management practices.
• Apply access controls, testing, human oversight, and audit requirements when using AI-assisted workflows to improve analysis and efficiency.
• Monitor platform health, maintain technical documentation, share knowledge, and contribute to security projects.
• Participate in on-call rotations, including nights, weekends, and holidays; perform other duties as assigned.
• Follow company policies, processes, and legal guidelines; meet attendance expectations as required by the department.

Technologies:

• AI
• Cloud
• Support
• Network
• Security
• WAF
• Web

More

We are Credit Acceptance, building on a successful business while investing in technology, data, AI, and continuous improvement. Our Engineering teams collaborate across the organization to address complex challenges, build impactful solutions, support informed decisions, and help modernize the business. We value curiosity, learning, innovation, accountability, customer empathy, and a collaborative, one-team approach. The role offers a competitive base salary of $101,605–$142,247 and eligibility for an annual variable cash incentive of 7.5%–15%; final compensation depends on factors including hub location, role-specific skills, experience, industry background, education, and certifications. Our benefits include a 401(k) match, adoption assistance, parental leave, tuition reimbursement, comprehensive medical, dental, and vision coverage, and additional benefits. The position follows a hybrid schedule of two work-from-home days and three standard in-office days each week, with the team and key stakeholders at a local office. Occasional travel to a Credit Acceptance building may be required.

last updated 43 week of 2026