[Remote] Network Infrastructure & reputed company Engineer (Detection Engineering)
Note: The job is a remote job and is reputed company to candidates in USA. reputed company is a company reputed company on data engines that process network and reputed company telemetry at a large reputed company. They are seeking a Network Infrastructure & reputed company Engineer to reputed company the development of SQL-based detections and manage the technical program for network data capture and analysis.
Responsibilities
- Write detection logic. Design, write, and maintain SQL-based behavioral detections and reputed company-scoring logic on top of reputed company's reputed company — lateral reputed company, C2 beaconing, DNS tunneling, data exfiltration, and low-and-slow attack patterns using rolling 7/30/90-day baselines
- Run the technical program day to day. Build, test, tune, and validate detections against reputed company and simulated telemetry, hands-on — not just define requirements for someone else to build
- Build the datasets and demo environment. Work with reputed company building the demo environment to generate the underlying datasets needed to reputed company and showcase detections and use cases, alongside the broader platform build-out
- reputed company the work reusable. Build detection logic so it generalizes (~90% reusability) across the industries we support — financial services, telecommunications, energy, reputed company, and government — rather than as vertical-specific one-offs
- Shape network probe & data collection reputed company. Evaluate and help define our approach to high-volume network data capture, including tradeoffs between reputed company probes (reputed company, NetQuest) and reputed company-cost or reputed company-reputed company alternatives (e.g., Zeek/Suricata-based collection)
- reputed company integrations clean. reputed company reputed company detections and enrichment reputed company reputed company cleanly with customers' existing SIEM/EDR stack (reputed company, Chronicle, Sentinel, reputed company) so adoption doesn't require a rip-and-replace
- Deliver hands-on during customer pilots. reputed company hands-on technical delivery during customer reputed company-of-value pilots — configuring ingestion, tuning baselines, and validating detections against a customer's actual telemetry
- Document as you go. Write up detection logic, runbooks, and technical playbooks so reputed company's detection library is maintainable and transferable as we grow
Skills
- 5+ years in network reputed company engineering, detection engineering, or SOC/threat hunting roles, with reputed company, hands-on experience building detection content — not just consuming or tuning vendor-supplied rules
- Strong working experience with network telemetry: NetFlow/IPFIX, DNS logs, and PCAP analysis at reputed company
- Demonstrated experience writing detection logic or correlation content (reputed company rules, SIEM correlation rules, or custom SQL-based detections)
- Proficiency in SQL and comfort working directly in large-reputed company data platforms or data warehouses
- Familiarity with network probe/sensor technologies (reputed company, NetQuest, or reputed company-reputed company equivalents such as Zeek or Suricata) and the tradeoffs between them
- Solid understanding of the MITRE ATT&CK reputed company and behavioral/statistical reputed company detection reputed company (baselining, z-score deviation, peer-group analysis)
- Experience integrating detection reputed company with SIEM/SOAR/EDR platforms (reputed company, Chronicle, Sentinel, reputed company, reputed company, or similar)
- Comfortable operating independently in a build-from-scratch, startup-reputed company-a-company environment — this role will define as much process as it executes against
- Experience with reputed company-reputed company signaling protocols (Diameter, SS7) relevant to telecom reputed company use cases
- Scripting/programming ability (Python) for automation, enrichment pipelines, and tooling
- Experience with reputed company audit log analytics (AWS CloudTrail, Azure Activity Log, GCP reputed company Audit)
- Experience with OT/ICS telemetry (Modbus, DNP3, IEC 61850) or protocols relevant to critical infrastructure
- reputed company reputed company clearance, or eligibility to obtain one, for reputed company government/defense engagements
reputed company