Cyber Defense - Defense Engineering Service Lead

POSITION SUMMARY

Zoetis is seeking a Defense Engineering Service Lead, you will lead hands-on detection engineering and Security Operations Center (SOC) operations to rapidly identify, contain, and resolve security threats for enterprise clients. Your expertise in MITRE ATT&CK, adversary tradecraft, and security technologies (SIEM, EDR, NDR) will drive the creation and tuning of high-quality detections, complex investigations, and proactive threat hunting. You'll automate response playbooks and integrate tools to build a cohesive defense ecosystem, partnering closely with cross-functional teams to improve signal fidelity, reduce false positives, and accelerate detection and response. In addition, you will mentor analysts, manage client relationships, and ensure programs meet industry frameworks and compliance standards, delivering operational excellence in a fast-paced environment.

POSITION RESPONSIBILITIES

Manage Log Ingestion and Data Normalization:

• Oversee the onboarding and integration of log sources across enterprise environments, ensuring reliable data ingestion, parsing, and enrichment.

• Maintain adherence to a Common Information Model (CIM) to standardize event fields, promote interoperability among security tools, and maximize detection fidelity and coverage.

Engineering & Automation:

• Design, develop, and maintain incident response playbooks, orchestrations, and automation for rapid response and evidence collection.

• Integrate and script security tools to create an efficient, cohesive, and automated defense ecosystem.

• Continually optimize detection logic and playbooks based on ongoing threat intelligence and operational feedback.

Threat Hunting & Readiness:

• Lead hypothesis-driven threat hunting across endpoints, identity, network, and cloud infrastructure to uncover unknown threats.

• Conduct continuous detection QA and tuning to enhance signal fidelity, reduce false positives, and improve analyst efficiency.

• Stay current on evolving threats, leveraging new detection and hunting methodologies as needed.

Incident Response & Purple Teaming:

• Serve as a hands-on incident responder, focusing on rapid containment and translating lessons learned into improved detections and processes.

• Partner with Red Team and IR colleagues on purple team exercises to validate detection coverage and address identified gaps.

Metrics & Continuous Improvement:

• Develop, track, and report on detect

  About Zoetis
  
  At Zoetis, our purpose is to nurture the world and humankind by advancing care for animals. As a Fortune 500 company and the world leader in animal health, we discover, develop, manufacture and commercialize vaccines, medicines, diagnostics and other technologies for companion animals and livestock. We know our people drive our success. Our award-winning culture, built around our Core Beliefs, focuses on our colleagues' careers, connection and support. We offer competitive healthcare and retirement savings benefits, along with an array of benefits, policies and programs to support employee well-being in every sense, from health and financial wellness to family and lifestyle resources.

  Notice: Zoetis Recruiters will contact candidates via email from an address ending in @zoetis.com and may also initially connect with candidates through LinkedIn, including LinkedIn InMail. Zoetis does not use Gmail, Outlook, Yahoo, or other web-based/generic email domains to communicate about job opportunities, interviews, or offers of employment. If you receive a recruitment-related email message claiming to be from Zoetis that does not come from @zoetis.com, please treat it as suspicious. For your security, do not reply, click links, open attachments, share personal or financial information, or send money in response to unexpected or questionable recruitment communications.

  Global Job Applicant Privacy Notice