Description
You will be responsible for the lifecycle of threat detection in this role. You will write logic on a wide variety of security platforms to detect malicious activity in various stages of the attack lifecycle. You will build attack simulation scenarios, reproduce attack scenarios, and test the effectiveness of yours and your peers logic. You will also partner with the engineering teams to develop technology that enables this work. You will closely collaborate with the incident response team to improve the reliability and quality of alerts. Your technical skills, collaboration and teamwork will help to ensure that our detection system works well to Secure Salesforce and its customers. If you want to solve interesting challenges in threat detection and some unique cyber security challenges this is the place you want to be in.
As a Lead Threat Detection Engineer, you will take on complete ownership of a technical area, responsible for delivering all necessary research and features to achieve our team’s goals in that area. You will work across teams in multiple geographies to deliver on initiatives with many moving parts. You will also have the opportunity to lead broad initiatives that go beyond our own work. We value innovation and expect everyone to innovate and come up with creative ways to solve the problems that we and our customers face.
Core Skills:
Cyber Security professional with over 10 years, including at least 8 years hands on experience in Threat Detection, Threat Hunting, Security Incident Response, and managing significant security incidents and breaches.
Must be a U.S. government cleared candidates to work on government-related projects and environments.
Experience and expertise in developing and refining threat detection methodologies is a prerequisite. This proficiency in leveraging security logs from multiple log source types which includes network infrastructure, endpoint devices, public and private cloud substrates and SaaS A comprehensive grasp of log structure, data normalization techniques, and the capacity to isolate critical security incidents is imperative..
Strong proficiency and experience in log correlation techniques to identify patterns and anomalies indicative of malicious activity. Demonstrate expertise in constructing complex search queries using languages such as SPL, YARAL and other query languages to analyze large volumes of data. Possess strong data analysis skills to interpret query results, identify false positives, and fine-tune detection rules for optimal efficacy.
Demonstrate in-depth knowledge of fundamental security principles, common attack vectors employed by threat actors, Tactics, Techniques, and Procedures (TTPs) used throughout the cyber kill chain, and relevant security frameworks such as the MITRE ATT&CK framework. This understanding is crucial for developing context-aware and effective detection strategies.
Possess practical experience in working with a variety of security tools and technologies, including Security Information and Event Management (SIEM) systems for centralized log analysis and alerting, Endpoint Detection and Response (EDR) solutions for endpoint visibility and threat mitigation, Network Detection and Response (NDR) tools for network traffic analysis and anomaly detection, and Security Orchestration, Automation and Response (SOAR) platforms for automating incident response workflows.
Demonstrate the ability to effectively handle and analyze large and complex datasets, identifying meaningful security insights and trends from vast amounts of information. This includes understanding data processing pipelines, performance considerations when querying large datasets, and the ability to synthesize findings into actionable intelligence.
Preferred Skills:
Hands on experience with any log aggregation/SIEM tool such as and not limited to Splunk , Elastic (ELK), FLINK , SQL etc
Experience with public cloud, such as AWS or Azure or GCP, especially Public cloud security.
Undergraduate degree in cyber security, computer science, information technology, or similar subjects.
Experience working in a globally distributed team leveraging documentation and async communications as needed
Prior experience or basic knowledge on Data analysis algorithms and methodologies
Experience on automation platform such as SOAR would be preferred