Department Description:

At Disney, we’re storytellers. We make the impossible, possible. The Walt Disney Company is a world-class entertainment and technological leader. Walt’s passion was to continuously envision new ways to move audiences around the world—a passion that remains our touchstone in an enterprise that stretches from theme parks, resorts and a cruise line to sports, news, movies and a variety of other businesses. Uniting each endeavor is a commitment to creating and delivering unforgettable experiences — and we’re constantly looking for new ways to enhance these exciting experiences.

The Enterprise Technology mission is to deliver technology solutions that align to business strategies while enabling enterprise efficiency and promoting cross-company collaborative innovation. Our group drives competitive advantage by enhancing our consumer experiences, enabling business growth, and advancing operational excellence.

The Global Information Security (GIS) group provides services to protect the value and use of Disney’s information through collaboration, standardization, enforcement, and education across The Walt Disney Company.  The main focus areas of this group are:

• Reduce the risk of both accidental and malicious data disclosure
• Identify, monitor, engage with complete inventory of information
• Establish appropriate policies and procedures to be followed
• Educate user community to minimize risk

Team Description:

The GIS Anomaly Detection Team is responsible for delivering advanced cybersecurity capabilities across the enterprise, including enhanced threat detection, proactive threat hunting, threat emulation, and purple teaming. The team collaborates with various segments to strengthen defenses, improve overall security posture, and reduce risk across the company.

Responsibilities of Role:

We are seeking a motivated and enthusiastic Security Engineer to join our GIS Anomaly Detection Team. This role is ideal for individuals who are eager to learn and grow in a dynamic environment. In this role, you will gain exposure to multiple cybersecurity disciplines. This position is highly flexible—you will support various functions such as threat hunting, detection engineering, threat emulation, and purple team as needed. You will collaborate with teams such as Security Operations Center (SOC), Cyber Threat Intelligence (CTI), Incident Response (IR), and Red Team to strengthen our security posture.

Key Responsibilities:

• Detection Content Development: Learn to create and tune basic detection rules, alerts, and dashboards in tools like Splunk under guidance from senior engineers.
• Threat Hunting Support: Support proactive threat hunting activities by gathering data, running queries, and documenting findings.
• Threat Emulation Support: Participate in purple team exercises and threat emulation activities to validate detection coverage and improve defenses.
• Collaboration: Work closely with SOC, CTI, IR, and Red Team to share insights and assist in joint security initiatives.
• Continuous Learning: Stay current with cybersecurity fundamentals, frameworks (e.g., MITRE ATT&CK), and emerging threats. Participate in training and mentorship programs to build technical expertise.
• Documentation: Maintain clear and accurate records of activities, findings, and improvements. Contribute to team knowledge bases and reporting efforts.

Must Haves:

• Experience in cybersecurity (internships, academic projects, or lab work acceptable).
• Strong typing proficiency and attention to detail.
• Basic understanding of networking, operating systems, and core cybersecurity principles.
• Familiarity with security concepts such as threat detection, threat hunting, and MITRE ATT&CK framework (academic exposure or self-study acceptable).
• Familiarity with SIEM tools (e.g., Splunk) for detection and analysis.
• Basic knowledge of data analysis or statistics for anomaly detection.
• Basic scripting knowledge (Python or PowerShell) and willingness to learn.
• Strong analytical and problem-solving skills.
• Effective written and verbal communication skills.
• Familiarity with AI concepts and their application in cybersecurity.

Nice To Haves:

• Exposure to threat emulation or purple team exercises.
• Hands-on experience with Splunk or similar SIEM tools (even in academic or lab settings).
• Knowledge of cloud environments (AWS, Azure, Google Cloud) and basic security considerations.
• Understanding of threat intelligence and how it informs detection and hunting.
• Experience with cybersecurity competitions, Capture the Flag (CTF), or related projects.
• Awareness of red team operations and how they contribute to improving defenses.

Education:

• Bachelor's degree in Computer Science, Information Systems, Software, Electrical or Electronics Engineering, or comparable field of study, and/or equivalent work experience

The hiring range for this position in Los Angeles, CA is $89,000.00 - $119,300.00 per year. The base pay actually offered will take into account internal equity and also may vary depending on the candidate’s geographic region, job-related knowledge, skills, and experience among other factors. A bonus and/or long-term incentive units may be provided as part of the compensation package, in addition to the full range of medical, financial, and/or other benefits, dependent on the level and position offered.