Description

You will work as an analyst on the observation management team to ensure the scalability of data sources used for actionable detections.

Responsibilities

• Develop and maintain Python and YAML-based pattern matches, software, and systems.
• Optimize data retention and storage to minimize costs while maintaining security efficacy.
• Build and improve processes for determining data value with input from cross-functional teams.
• Conduct code and configuration reviews to ensure quality and maintainability.
• Research threat surfaces and telemetry to develop expertise and novel reductions.
• Build runbooks, reports, and supporting material for detection surfaces.

Required Skills

• 5-7 years of professional experience as a Software Developer or equivalent role.
• Proven experience contributing to projects using Python or YAML.
• Familiarity with Snort/Suricata rules and network signatures/detections.
• Understanding of IDS/IPS, Proxy, Firewall, SSE, VPN, and other network products.
• Knowledge of on-premises Active Directory architecture, including domains, trusts, OUs, and GPOs.
• Understanding of AD telemetry, including event logs, monitoring, and analysis.
• Ability to write clean, efficient, and reusable Python code.
• Capability to optimize application performance and ensure scalability.

Preferred Skills

• Professional certifications in Security or Networking (e.g., CISSP, GNFA, GCFA, GCFE, GREM).
• Experience working in a Security Operations Center (SOC) or supporting SOC development.
• B.Sc. in Computer Science.

Key Skills

Education

Any Graduate