Detection and Response Engineer

WHAT YOU'LL DO

• Participate in on-call rotation responding to and triaging security events, performing security investigations, and incident analysis while effectively communicating findings to key stakeholders
• Participate in threat modeling scenarios with cross-functional partners to understand weaknesses across Cloud, Mobile, Endpoints, and other environments
• Develop and optimize tailored detection signatures, response playbooks, and response automation using detection-as-code principles
• Develop and maintain large-scale data pipelines, ensuring reliability, timeliness, and accuracy of data being ingested across cloud, SaaS, enterprise, and product environments
• Participate in threat hunting initiatives, collaborating with various engineering and product teams to emit signals to incorporate into detections, new telemetry ingestion, and/or security controls

REQUIRED QUALIFICATIONS

• Broad range of practical security knowledge across the spectrum of endpoint, network, identity, application, and cloud infrastructure
• Programming experience in one or more general purpose languages (Python, SQL, Go, etc)
• Experience building and refining SIEM tools, large-scale data pipelines, and logging architecture
• Experience investigating, responding to, and remediating incidents
• Experience in security monitoring, log analysis, and detection engineering within large data sets across endpoint, network, and a wide variety of application log sources
• Strong knowledge of attacker tactics, techniques, and procedures (TTPs)
• Strong communication skills and experience collaborating with internal and external stakeholders
• Must be able to obtain and hold a U.S. Top Secret security clearance

PREFERRED QUALIFICATIONS

• Experience working in a traditional software development lifecycle (i.e. Github, CI/CD, unit testing)
• Experience conducting incident response in the Cloud (AWS, Azure, GCP)
• Proficiency in AWS security controls and services
• Experience proactively threat hunting using threat intelligence to identify potential risks and weaknesses in telemetry