Security Engineer (Blue Team)

What you'll do

• Build and improve security detection mechanisms and automation frameworks for the Security Operations Center.
• Develop tooling and data delivery mechanisms to detect threat actors within the production environment.
• Create automation workflows to reduce the time required to triage security detections.
• Develop services to pull in new datasets or enrich existing security data.
• Identify and prioritize detection gaps by engaging with owners of high-risk systems and services.
• Investigate anomalous or suspicious behavior identified during the detection engineering process.
• Participate in adversary emulation activities to identify and address environmental detection gaps.
• Build ETL pipelines from diverse systems to optimize logging formats for threat detection.

What we're looking for

• Bachelor’s degree in a STEM discipline or 2+ years of professional experience in incident response, security operations, or security engineering.
• Experience with modern programming languages such as Python, Go, C++, or Rust.
• Experience performing Incident Response tasks or contributing to a CSIRT team (preferred).
• Experience building ETL pipelines from diverse systems to optimize logging formats for threat detection (preferred).
• Ability to support and manage services in a Kubernetes environment with high availability and infrastructure automation (preferred).
• Knowledge of traditional Security Operations, SIEM systems, and Red Team attack trends (preferred).
• Familiarity with enterprise security controls for Windows, Linux, and/or macOS systems (preferred).
• Must be a U.S. citizen, national, lawful permanent resident, refugee, asylee, or eligible for Department of State authorization.