Detection and Response Engineer

November 12

Apply Now

Receive Emails with Similar Jobs

Expel

WebsiteLinkedInAll Job Openings

Transparent managed security • Resilience recommendations • Monitor 24x7 • Investigate and respond • Snark

201 - 500

Description

•Imagine yourself as a SOC analyst and a new alert shoots to the top of the queue. You open the alert and all of the relevant facts are laid out for you. You know the whos the whats and the wheres of what happened and it’s all right there in the alert. You notice the attacker IP immediately you wonder “Where is that IP located?”. Wonder no more because the IP has already been fully enriched with all publicly available information! This looks bad, just as you’re about to shift to the EDR console to see what kind of damage was done, you notice further down that’s already been provided for you. You have full context of everything that happened before, during and after this event and it’s confirming your suspicions. You raise the alarm and notify the customer that you’re digging into a potential security incident and it only took 20 seconds to make that decision. •Now imagine you are the one who created that alert. You understand security operations and have a keen understanding of what information is needed to make an informed decision about a potential attack. You know the sort of enrichment needed to provide the right context about the facts of the alert. You have studied the metrics from previous investigations and know where analysts get tripped up or slowed down on decisions during the moments that matter. You streamline the response process through automation and make sure the decisions can be made quickly. Now imagine that the SOC analyst never even needed to triage the alert because of your automations, it was automatically promoted to an incident for the SOC. •You also enjoy working together on a team to prioritize the problems that matter and work toward a solution. And you have a high degree of empathy and understand the demands of working in a SOC environment. You understand that scaling operations doesn’t always mean scaling with more people, the real strength comes when you can arm analysts with the tools they need to become super heroes. •Does this sound like you? At Expel, we’re taking a new approach to managed security. We spend our time trying to discover ways to keep our customers safe and our security analysts happy. We’re trying to meet our customers where they are—understanding a vast number of attacker tactics, security vendor capabilities, and customer requirements. We believe innovating while handling the combinatorial explosion represents a captivating problem. If you agree, we may have the job for you!

Requirements

•1+ years of experience with detection and response tools, particularly EDR, NSM, and SIEM •1+ years of experience writing, deploying and tuning custom detections based on research or investigative work against common data sets (Windows Event Logs, auditd, CloudTrail, and similar datasets) •Proficiency of Python, Go or other object oriented programming languages •Strong understanding of Windows, macOS and Linux operating systems and command line tools •Knowledge of networking basics, such as TCP/IP and OSI model •Working knowledge and observations of attack vectors, threat tactics, and attacker techniques •Understanding of cloud infrastructure platforms and their Identity and Access Management (IAM) models •Bachelor’s degree in Computer Science or Information Security strongly preferred •3+ years of professional experience in information technology or security operations would be ideal but not required

Benefits

•25 days annual leave in addition to public holidays •Parental leave •Excellent health benefits