Description

You will implement, configure, and maintain security detection rules across on-premise and Google Cloud environments. You own the detection engineering lifecycle, from threat modeling to incident response.

Responsibilities

• Implement and maintain security detection rules using the MITRE ATT&CK Framework for gap assessment and analysis.
• Lead incident response efforts, conducting forensic analysis and root cause investigations, with a focus on Kubernetes environments.
• Perform proactive threat hunting and tune intrusion and anomaly detection systems to reduce noise and improve signal accuracy.
• Develop automation scripts in Python and Bash to streamline security operations and integrate with CI/CD pipelines.
• Maintain comprehensive documentation for detection configurations, incident procedures, and investigation findings.

Required Skills

• 8+ years of experience in cloud security, detection engineering, or security operations.
• Proficiency in Python and Bash for scripting and automation tools.
• Hands-on experience with Splunk Enterprise Security or equivalent SIEM solutions for log analysis and monitoring.
• Deep understanding of Kubernetes, including incident response and forensic analysis within containerized environments.
• Practical application of the MITRE ATT&CK Framework for threat detection and mitigation.
• Experience with cloud security detection tools, including anomaly detection and log analysis.
• Bachelor's degree in a related field or equivalent professional experience.
• Google Cloud Professional Cloud Security Engineer certification or equivalent demonstrated expertise.

Preferred Skills

• Experience with threat emulation solutions such as Atomic Red Team, PurpleSharp, or Safebreach.
• Relevant certifications including CISSP, GCIH, GCIA, CKA, or Splunk certifications.
• Experience working with Test Driven Development practices in security automation.

Key Skills

Education

Bachelor's degree