Match score not available

Security Detection Engineer

Remote:

Full Remote

Contract:

Full time

Experience:

Mid-level (2-5 years)

Work from:

United States

Offer summary

Qualifications:

Bachelor’s degree in computer science or related field, 3-5 years of experience in cybersecurity, Relevant certifications (e.g., Security+, CySA+), Firm understanding of attacker tactics and detection, Knowledge of cloud security platforms.

Key responsabilities:

Develop and improve the cybersecurity detection program
Drive development of alerting rules and reports
Analyze attacker tactics to develop countermeasures
Guide SOC team in threat detection enhancement
Manage gap analyses and Security Lab for testing

Thrive* Large https://www.thrivenextgen.com/

1001 - 5000 Employees

See more Thrive* offers

Job description

About Us
Thrive is a rapidly growing technology solutions provider focusing upon Cloud, Cyber Security, Networking, Disaster Recovery and Managed Services. Our corporate culture, engineering talent, customer-centric approach, and focus upon “next generation” services help us stand out amongst our peers. Thrive is on the look-out for individuals who don’t view their weekdays spent at “a job”, but rather look to develop valuable skills that ignite their passion and lead to a CAREER. If you’re attracted to a “work hard, play hard” environment, seeking the guidance, training, and experience necessary to build a lucrative career, then welcome to THRIVE!!

Position Overview

We're looking for a Security Detection Engineer to spearhead the advancement of Thrive's cybersecurity detection program. This role is crucial for driving the development of alerting rules, hunts, queries, and reports, as well as implementing and refining SIEM & Detection tooling and procedures. The ideal candidate will analyze attacker tactics, techniques, and procedures (TTPs), developing countermeasures and collaborating with our team to fortify security controls. Responsibilities include guiding the SOC team in improving threat detection, managing security gap analyses, and overseeing the Security Lab for testing attack methods. Additionally, this position involves researching emerging threats to refine detection strategies and managing KPIs to track and enhance the effectiveness of our threat detection efforts.

Primary Responsibilities

Responsible for the development and continuous improvement of Thrive’s cybersecurity detection program
Drive continuous development of all new alerting rules, hunts, queries, and reports
Develop, implement, document, and maintain SIEM & Detection tooling, standard operating procedures, attack signatures and test scripts
Implementation and management of API security measures, ensuring secure data transmission and compliance with industry-standard API security protocols
Analyze attacker TTPs and build countermeasures to detect and/or stop them using endpoint telemetry
Work with security analysts and engineers to develop security controls based on threat model and gap
Provide guidance and support to the SOC team in enhancing threat detection capabilities.
Design and manage Thrive’s gap analysis and threat modeling processes
Management of the Security Lab and responsible for testing new and existing TTP’s and attacks
Research threats, malware and novel behavioral techniques and then apply that research to build or tune detection rules and analytics
Develop and manage KPIs to measure and enhance the effectiveness of our threat detection strategies
Other duties as required

Qualifications/Required Skills

Bachelor’s degree in computer science, Information Technology, or a related field.
Relevant certifications (e.g., Security+, CySA+, Network+)
3-5 years of experience in cybersecurity or a related field
Firm understanding of attacker tactics, techniques, procedures and means of detection
Solid understanding of the MITRE ATT&CK and Cyber Kill Chain frameworks
Understanding of common enterprise technologies and logging capabilities including Cloud, IDS/IPS, Firewalls, Active Directory, Anti-Virus/EDR, Proxies, and Email Gateway
Ability to engineer creative, scalable, and out-of-the-box solutions
Stay up to date with engineering best practices, security technology trends, tools, and frameworks
Experience with scripting languages (e.g., Python, PowerShell)
Knowledge of cloud security platforms (e.g., Azure, AWS, GCP)
Must be able to work effectively in a team environment and collaborate within the team and other stakeholders
Familiarity with common security technologies, such as firewalls, intrusion detection/prevention systems, and antivirus software
Basic understanding of networking concepts and protocols (TCP/IP, DNS, HTTP).
Strong problem-solving and analytical skills
Excellent communication and interpersonal skills
Ability to work independently and as part of a team.
Ability to communicate security information to non-technical people
Demonstrates comprehension of good security practice
Knowledge of risk assessment tools, technologies and methods