Security Engineer Investigator, Account Threats
Washington, DC
We are seeking an experienced security engineer to proactively detect and analyze root causes of account security abuses, investigate complex threats to our business and users, advance investigative methods, conduct data-driven decision making, and use innovative approaches to protect people from harm. The candidate must have a strong cybersecurity or cyber threat intelligence background and know how to apply it to proactively hunt for threats, be able to use code to automate investigative actions, and be proficient in scripting languages, such as PHP or Python.
The ideal candidate will be an innovative self-starter, who is motivated by our mission, is results-driven, a strategic thinker, and will be able to extract, assimilate, and correlate a wide variety of data in order to surface and disrupt account security abuses.Security Engineer Investigator, Account Threats Responsibilities
- Proactively hunt for threats and undetected abuse by leveraging internal data, open source intelligence, and third-party private intelligence.
- Investigate complex account security abuses to understand in granular detail how abuse is occurring. Identify and implement appropriate detection or prevention strategies to mitigate harm both in the current case and from similar forward-looking abuse.
- Understand the application of tactics, techniques, and procedures, as well as tooling, that actors use across various attack surfaces.
- Lead technical investigations from start-to-finish, to include effectively communicating actionable results, analytic judgments, and mitigations to different audience types across cross-functional settings.
- Self-directed identification of trends in adversary behavior, and proactive surfacing of risks that may represent previously unidentified or novel vectors for harm. Deeply understand how abuse manifests and clearly explain emerging threats and trends, with an emphasis on security understanding.
- Analyze and interpret complex, high volume, and high dimensionality data from varying sources to advance investigations, quantify trends, or support findings.
- Take a leadership role in suggesting, prototyping, and teaching novel investigative techniques.
- Partner with other cross-functional teams to identify, influence, and implement holistic solutions to surfacing and responding to emerging threats.
- Manage multiple projects at once while effectively prioritizing time, based on team priorities.
- Automate the everyday tasks and actions conducted during investigations and team processes.
- 5+ years work experience in a cyber security, security investigations, or cyber threat intelligence investigations role.
- Adept at formulating queries to analyze and interpret large datasets to advance investigations, quantify trends, or support findings.
- Experience investigating and acting on high-impact threats such as account compromise, account creation abuse, business compromise, or malware analysis.
- Proficiency working with Python, PHP, or similar scripting languages.
- Demonstrated experience to think critically and effectively articulate well-reasoned assessments within cross-functional settings, while possessing proficient communication skills to influence stakeholders with varying levels of technical expertise across all organizational levels.
- Experience identifying effective strategies to prevent or disrupt abuse at scale. Consult on the design of countermeasures to affect those strategies.
- Experience working with a team spanning multiple locations/time zones.
- Proficiency in detecting, mitigating, and sizing account abuse for a Web-based service, to include experience with authentication attacks, account generation abuse, bot detection, evasion detection, and/or browser fingerprint analysis.
- 3+ years of red or purple teaming exposure.
- Proficiency in static and dynamic analysis of malicious software to understand behaviors and intent of the malicious software. Experience should include leveraging results to derive digital fingerprints, create detection signatures (e.g. file, network), and/or hunt for malware.
- Deep technical and data analysis experience to analyze custom protocols to understand and expose adversarial behaviors.
- Experience understanding tactics, techniques, and procedures (TTPs) and actor intent, including extracting this from malware.
- Experience in scoping, communicating, and leveraging cyber threat intelligence to proactively detect, measure, or prevent abuse.
- Experiencing tracking highest priority malware campaigns.
- Experience using SQL for data analytics and processing large data sets.
- Demonstrated interest in understanding the intersection of global security risks, and how they apply to social media.
- Experience with open source investigation techniques and familiarity with a variety of internet research tools.
- BS/MS or equivalent experience in Computer Science, Information Systems, Intelligence Studies, Cybersecurity or related field.
- Experience working across or contributing to the broader security community (public research, blogging, presentations, open source contributions, etc.)
Individual compensation is determined by skills, qualifications, experience, and location. Compensation details listed in this posting reflect the base hourly rate or annual salary only, and do not include bonus, equity or sales incentives, if applicable. In addition to base compensation, Meta offers benefits. Learn more about benefits at Meta.
Tags: Analytics Computer Science Data Analytics Malware Open Source PHP Physics Prototyping Python Scripting SQL Teaching Threat intelligence TTPs
Perks/benefits: Career development Equity / stock options Health care Salary bonus
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Product Security Engineer jobs
- Open Senior Cybersecurity Engineer jobs
- Open Senior Cyber Security Engineer jobs
- Open Information Security Officer jobs
- Open Information Security Specialist jobs
- Open Principal Security Engineer jobs
- Open Senior Penetration Tester jobs
- Open Cloud Security Architect jobs
- Open Chief Information Security Officer jobs
- Open IT Security Engineer jobs
- Open Staff Security Engineer jobs
- Open Cyber Security Specialist jobs
- Open Senior Network Security Engineer jobs
- Open Senior Product Security Engineer jobs
- Open Security Specialist jobs
- Open Cyber Security Architect jobs
- Open Security Operations Analyst jobs
- Open Cybersecurity Consultant jobs
- Open Information System Security Officer jobs
- Open Security Consultant jobs
- Open Information Systems Security Officer jobs
- Open Senior Information Security Analyst jobs
- Open Information Security Architect jobs
- Open Ethical hacker / Pentester H/F jobs
- Open Senior Security Architect jobs
- Open CISA-related jobs
- Open Agile-related jobs
- Open Risk assessment-related jobs
- Open Analytics-related jobs
- Open SOC-related jobs
- Open Network security-related jobs
- Open GCP-related jobs
- Open ISO 27001-related jobs
- Open IAM-related jobs
- Open Application security-related jobs
- Open DoD-related jobs
- Open DevOps-related jobs
- Open Pentesting-related jobs
- Open Threat intelligence-related jobs
- Open APIs-related jobs
- Open Java-related jobs
- Open Vulnerability management-related jobs
- Open Security Clearance-related jobs
- Open Kubernetes-related jobs
- Open SaaS-related jobs
- Open CEH-related jobs
- Open Malware-related jobs
- Open Security assessment-related jobs
- Open SQL-related jobs
- Open PowerShell-related jobs