Activision Blizzard

Expert Detection and Response Engineer (Remote)

Irvine - Blizzard - Blizzard Way · Part-time

Sponsorship not specified$124k-$229kDetected 12 days ago

PythonPowerShellLLMsCybersecuritySIEMKQLSOARSOC OperationsDetection EngineeringIncident ResponseResearchLeadershipCommunicationMentoring

About the role

Activision is seeking an Expert Detection and Response Engineer to help protect our players, studios, platforms, and enterprise environments from advanced cyber threats.
As part of our Global Security Operations organization, this role is responsible for actively identifying, investigating, and responding to security threats.
This role is highly hands-on and focuses on real-world attacker behavior, rapid analysis, and effective containment.

Perform alert triage, in‑depth investigation, and forensic analysis across the full incident lifecycle, from identification through containment, remediation, and post‑incident review.
Develop, refine, and tune threat detections within the SIEM based on real‑world attacker behavior and investigation findings.
Design, build, or operate AI/LLM-assisted triage and enrichment workflows (e.g., agentic pipelines integrated with case management platforms) to accelerate investigation and reduce analyst toil.
Evaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict-poisoning risks introduced via analyzed artifacts, applying schema-constrained or otherwise bounded output design rather than relying solely on input-side filtering.
Collaborate closely with engineering teams, business stakeholders, and vendors during active investigations and response efforts.
Participate in an on‑call rotation and provide off‑hours support for critical incidents and material security events.
Willingness to participate in an on‑call rotation and provide off‑hours support for critical security incidents.
Scripting or programming experience (e.g., Python, PowerShell, KQL) to support detection, investigation, or response automation.

Bachelor's degree in computer science, Information Security, or equivalent practical experience.
10+ years of progressively accountable security experience, with a demonstrated track record of independent, expert-level judgment in incident response.
Hands‑on experience in threat detection, security operations, and incident response, with active involvement across the full incident lifecycle.
Strong understanding of the modern threat landscape, attacker tactics, techniques, and procedures.
Proven ability to detect, triage, investigate, and respond to security incidents in enterprise environments.
Experience performing detailed log analysis, correlation, and investigative triage.
Strong written and verbal communication skills, with the ability to clearly articulate incident findings and response actions.
Ability to work independently and collaboratively within the TDIR team and with technical and business stakeholders.
Hands-on experience with security monitoring platforms such as SIEM and EDR, including building or significantly extending detection content (not solely tuning existing rules).

12+ years of relevant IT and security experience, including prior leadership or mentorship of less-senior analysts.
Hands‑on malware analysis experience using static and dynamic techniques.
Experience implementing or operating SOAR platforms and security automation.
Familiarity with emerging threat models for AI-augmented security tooling, such as prompt injection and verdict poisoning via analyzed artifacts.
Understanding foundational security best practices, including system and network hardening.
Ability to assess incidents quickly, recommend effective response actions, and mitigate operational and reputational risk.
Experience interfacing effectively with leadership, engineering teams, and external vendors.
We're not just looking back at our decades-long legacy

In the U.S., the standard base pay range for this role is $124,000.00 - $229,400.00 Annual.

This listing is sourced directly from Activision Blizzard's careers page and normalized into a canonical job model.