Description

You will act as an analyst on the observation management team, ensuring the scalability of data sources used for actionable detections.

Responsibilities

• Develop and maintain Python and YAML-based pattern matches, software, and systems.
• Optimize data retention and storage to minimize costs while maintaining security efficacy.
• Build and improve processes for determining data value through cross-functional collaboration.
• Research threat surfaces and telemetry to develop expertise.
• Write clean, efficient, and reusable Python code and conduct configuration reviews.
• Build runbooks, reports, and supporting material for detection surfaces.

Required Skills

• 5-7 years of professional experience as a Software Developer or equivalent role.
• Proficiency in writing Python and working with YAML.
• Experience with Active Directory architecture, including domains, trusts, OUs, and GPOs.
• Understanding of AD telemetry, event logs, monitoring, and analysis.
• Familiarity with Snort/Suricata rules and network signatures/detections.
• Knowledge of IDS/IPS, Proxy, Firewall, SSE, VPN, and other network products.
• Experience with on-premises environments.

Preferred Skills

• Experience working in a Security Operations Center (SOC) or supporting a SOC through development.
• Professional certifications such as CISSP, GNFA, GCFA, GCFE, or GREM.
• B.Sc. in Computer Science.

Key Skills

Education

Any Graduate