formulate new detection ideas based on adversary research, emerging attack techniques, industry incidents, and threat intelligence
lead and participate in incident response, performing root-cause analysis and driving preventive improvements post-incident
develop and enhance the CRED’s detection, monitoring and response capabilities
automate incident response workflows using playbooks and orchestration to reduce manual effort
build in-house security analytics solutions using open source tools (log parsing, event correlation and threat detection)research/conduct threat hunting operations using known adversary tactics, techniques and procedures to detect advanced threats
assist with creating security awareness and maintaining prudent security engineering culture within an organization
- enable compliance in teams and help them achieve some of the industry’s best practices (e.g. PCI DSS, ISO 27001)
- you should apply if you have:
- 2 to 6 years of experience in information security with a strong focus on threat detection and response
hands-on experience detecting and responding to threats across cloud (aws preferred), endpoint (windows/linux/macOS), and network telemetry
exposure to EDR, IDS/IPS, and SIEM / centralized logging platforms (splunk, ELK, sentinel, or similar), including building high-fidelity detection pipelines
proficiency in at least one programming or scripting language (python, go, or bash)
solid understanding of MITRE ATT&CK, cyber kill chain, and diamond model
ability to design and tune detection rules using MITRE ATT&CK and threat intelligence with a focus on signal quality
experience with threat hunting, automation and enrichment, regex creation, and false-positive reduction
experience handling the complete incident response lifecycle, from detection through remediation and reporting
strong data-driven mindset with the ability to influence both technical and non-technical stakeholders
ability to act as a go-to person, communicating clearly with engineering, product, and business teams
proactive approach to staying current with security news, breach reports, tools, and attacker research
strong learning agility and passion for exploring diverse security domains, demonstrated via github, blogs, research, or talks
exposure to the AI-driven threat landscape, digital forensics, or malware analysis is a strong plus