Cyber Security Engineer I

Powering the agentic revolution in travel. Sabre is an AI-native technology leader, backed by one of the worlds largest travel data clouds. Built on an open, modular, cloud-native architecture, Sabre serves as the backbone for both established leaders and bold, new disruptors, guiding them to the next age of travel retailing through intelligent, connected, and personalized experiences. With AI at its core and operating at unparalleled scale, Sabre transforms insights into innovation, empowering airlines, hoteliers, agencies and other partners to retail, distribute and fulfill travel worldwide. Cyber Security Engineer Threat Detection and Incident Response Location: Flexible / Hybrid Department: Risk & Security Cyber Threat Management (CTM) Reports To: Manager, Cyber Threat Management Position Overview Sabre is seeking a self-motivated Cyber Security Engineer with 2-3 yrs experience, to join our Cyber Threat Management (CTM) team. This role is responsible for identifying, investigating, responding to, and helping prevent cybersecurity threats across Sabre's global technology environment. The ideal candidate is enthusiastic about cybersecurity, has experience working in a Security Operations Center (SOC), Incident Response, Threat Hunting, or related security function, and possesses strong analytical and critical thinking skills. This individual will serve as a key contributor to Sabre's Cyber Incident Response Team (CIRT), participate in initiative-taking threat hunting activities, help improve detection capabilities, and support the ongoing evolution of Sabre's security operations program. Primary Responsibilities Threat Detection & Monitoring Monitor, investigate, and respond to security alerts generated from enterprise security platforms. Analyze suspicious events and recommend appropriate response actions. Identify indicators of compromise (IOCs), attacker tactics, techniques, and procedures (TTPs), and emerging threats. Assist in the development and tuning of detection logic, alerting rules, and automated response workflows. Collaborate with Managed Detection and Response (MDR) providers and internal stakeholders to validate and respond to potential threats. Incident Response Serve as a member of Sabre's Cyber Incident Response Team (CIRT). Participate in cybersecurity incident investigations throughout the incident response lifecycle, including identification, analysis, containment, eradication, recovery, and lessons learned. Perform security investigations independently while collaborating with senior team members on complex or high-severity incidents. Coordinate with infrastructure, cloud, application, and business teams during incident response activities. Document investigative findings, evidence, response actions, and remediation recommendations. Participate in tabletop exercises and post-incident reviews to strengthen organizational preparedness. Threat Hunting Conduct initiative-taking threat hunting activities to identify malicious activity that may evade automated detection. Analyze endpoint, network, identity, cloud, and security telemetry to identify anomalous or suspicious behavior. Research emerging cyber threats and assist in translating intelligence into actionable detection content. Develop and execute threat hunting hypotheses based on current threat intelligence and attack trends. Detection Engineering & Operational Improvement Create and optimize security detections within SIEM (Cortex XSIAM), endpoint protection, and other security monitoring platforms. Assist with improving automation and operational efficiency across security processes. Partner with engineering and infrastructure teams to improve security visibility and telemetry collection. Contribute to the evaluation and implementation of new security capabilities and technologies. Vulnerability & Risk Collaboration Partner with Vulnerability Management teams to assess emerging threats and critical vulnerabilities. Participate in threat-based vulnerability analysis and prioritization activities. Assist with providing risk-based recommendations to technology teams and system owners. Collaboration & Communication Communicate technical findings clearly to both technical and non-technical audiences. Prepare investigation summaries, incident documentation, and after-action reports. Build productive working relationships with security, infrastructure, cloud, application development, and business teams. Contribute to team knowledge sharing and continuous improvement initiatives. Demonstrate professionalism and composure during security incidents and operational escalations. Required Qualifications Bachelor's degree in Cybersecurity, Information Technology, Computer Science, or a related field (or equivalent practical experience). 23+ years of experience in Cyber Security, Security Operations, Threat Hunting, Incident Response, Vulnerability Management, or a related security discipline. Experience investigating cybersecurity .