Note: The job is a remote job and is open to candidates in USA. Activision is seeking an Expert Detection and Response Engineer for its Global Security Operations organization. The role protects players, studios, platforms, and enterprise environments by identifying, investigating, and responding to cyber threats, with a focus on hands-on detection, forensics, containment, automation, and AI-assisted security workflows.

Responsibilities

• Detect, investigate, and respond to security incidents across cloud, corporate, and production environments as a hands‑on member of the TDIR team
• Monitor and analyze security telemetry and audit logs to identify anomalous activity, unauthorized access, and emerging threats, including targeted attacks and advanced adversaries
• Perform alert triage, in‑depth investigation, and forensic analysis across the full incident lifecycle, from identification through containment, remediation, and post‑incident review
• Execute endpoint, identity, cloud, and malware investigations, including timeline reconstruction, indicator extraction, and root cause analysis
• Develop, refine, and tune threat detections within the SIEM based on real‑world attacker behavior and investigation findings
• Enhance investigation and response efficiency through automation, SOAR workflows, scripting, and advanced analytics
• Design, build, or operate AI/LLM-assisted triage and enrichment workflows (e.g., agentic pipelines integrated with case management platforms) to accelerate investigation and reduce analyst toil
• Evaluate and harden AI-assisted security tooling against adversarial input, including prompt injection and verdict-poisoning risks introduced via analyzed artifacts, applying schema-constrained or otherwise bounded output design rather than relying solely on input-side filtering
• Contribute to TDIR procedures, playbooks, runbooks, documentation, and operational metrics
• Collaborate closely with engineering teams, business stakeholders, and vendors during active investigations and response efforts
• Participate in an on‑call rotation and provide off‑hours support for critical incidents and material security events
• Communicate investigation findings clearly and effectively to technical teams and leadership
• Occasional travel (up to approximately 10%) may be required to support studios or on-site incident response

Skills

• Bachelor's degree in computer science, Information Security, or equivalent practical experience
• 10+ years of progressively accountable security experience, with a demonstrated track record of independent, expert-level judgment in incident response
• Hands‑on experience in threat detection, security operations, and incident response, with active involvement across the full incident lifecycle
• Strong understanding of the modern threat landscape, attacker tactics, techniques, and procedures
• Proven ability to detect, triage, investigate, and respond to security incidents in enterprise environments
• Experience performing detailed log analysis, correlation, and investigative triage
• Strong written and verbal communication skills, with the ability to clearly articulate incident findings and response actions
• Ability to work independently and collaboratively within the TDIR team and with technical and business stakeholders
• Willingness to participate in an on‑call rotation and provide off‑hours support for critical security incidents
• Hands-on experience with security monitoring platforms such as SIEM and EDR, including building or significantly extending detection content (not solely tuning existing rules)
• Scripting or programming experience (e.g., Python, PowerShell, KQL) to support detection, investigation, or response automation
• Strong host- and network-based forensic skills, including timeline reconstruction and root cause analysis
• Working knowledge of how LLMs are applied to security operations (alert enrichment, auto-triage, summarization) and the failure modes specific to that application, such as hallucinated verdicts, injection via log or artifact content, and over-trust in model output
• Fluency in English
• 12+ years of relevant IT and security experience, including prior leadership or mentorship of less-senior analysts
• Hands‑on malware analysis experience using static and dynamic techniques
• Experience implementing or operating SOAR platforms and security automation
• Hands-on experience building or integrating AI-assisted triage into a SOC workflow (SOAR, case management, or custom pipeline), including designing constrained output schemas or guardrails rather than relying solely on vendor-side content filtering
• Familiarity with emerging threat models for AI-augmented security tooling, such as prompt injection and verdict poisoning via analyzed artifacts
• Identity-focused detection experience, including Active Directory, hybrid identity, and privileged account monitoring
• Understanding foundational security best practices, including system and network hardening
• Ability to assess incidents quickly, recommend effective response actions, and mitigate operational and reputational risk
• Experience interfacing effectively with leadership, engineering teams, and external vendors
• Demonstrated engagement with the cybersecurity community or strong evidence of self‑driven learning and professional contribution

Benefits

• Subject to eligibility requirements, comprehensive medical, dental, and vision benefits.
• Subject to eligibility requirements, health savings account or health reimbursement account, healthcare spending accounts, and dependent care spending accounts.
• Subject to eligibility requirements, life and AD&D insurance and disability insurance.
• Subject to eligibility requirements, 401(k) with Company match.
• Subject to eligibility requirements, tuition reimbursement and charitable donation matching.
• Subject to eligibility requirements, paid holidays and vacation, paid sick time, and floating holidays.
• Subject to eligibility requirements, compassion and bereavement leaves and parental leave.
• Subject to eligibility requirements, mental health and wellbeing programs and fitness programs.
• Subject to eligibility requirements, free and discounted games.
• Subject to eligibility requirements, voluntary benefit programs including supplemental life and disability, legal service, ID protection, and rental insurance.
• If the Company requires you to move geographic locations for the job, you may also be eligible for relocation assistance.

Company Overview