Cyber Threat Detection & Response Engineer
TLDR
Engage in proactive threat hunting and detection engineering, providing real-time cyber defense solutions to Fortune 500 and government clients.
-
Proactively hunt for hidden threats across endpoints, networks, cloud, and applications.
-
Proactively create detection rules to alert SOC analysts of intrusions against customer networks.
-
Assist with tuning and enhancing existing detection rules to better defend against evolving threats.
-
Develop and execute hypotheses-driven threat hunting campaigns using security data and intelligence.
-
Analyze large volumes of log, endpoint, and network data to uncover anomalous or malicious activity.
-
Research and track adversary TTPs and leverage frameworks such as MITRE ATT&CK.
-
Collaborate with Detection Engineering to refine detection rules, signatures, and playbooks to improve threat detection.
-
Collaborate with Incident Response and SOC teams to investigate and contain security incidents.
-
Provide technical mentorship to junior threat hunters and SOC analysts. Partner with Threat Intelligence to operationalize indicators and adversary insights.
-
Contribute to continuous improvement of detection engineering and hunting methodologies.
-
Regularly engage with internal account teams and customers to help strengthen their security posture, identify weaknesses, report on findings, and report on detection strategies.
-
Provide technical insight to internal account teams and customers as needed.
-
U.S. citizenship is required
-
4+ years of experience in cybersecurity, with at least 2 years focused on threat hunting or detection engineering.
-
History of independently building custom behavior-based and/or threshold-based detections in customer environments from scratch.
-
Experience building detections in SentinelOne, Elastic, or CrowdStrike platforms.
-
Capable of independently identifying and tuning flaws in existing detections to reduce noise.
-
Experience independently building and performing hypothesis-driven threat hunts in customer environments.
-
Capable of clearly and concisely reporting findings from threat hunts.
-
History of meeting with customers to explain detections and threat hunt findings to senior leadership teams.
-
Experience working with and mapping detections to the MITRE ATT&CK framework.
-
Background knowledge in the cyber threat landscape, including threat actors, malware, and evolving TTPs.
-
Experience working with cyber threat intelligence analysts/teams to identify new detection opportunities.
-
Proficiency with SIEMs, EDR/XDR platforms, and log analysis tools.
-
Experience with scripting languages (Python, PowerShell, etc.) for scripting purposes.
-
Enjoy working in a team environment.
-
Willingness to learn from more senior team members while mentoring junior team members.
UltraViolet Cyber builds a cybersecurity platform that integrates security operations for enterprises, eliminating risks associated with traditional red and blue team approaches. Targeting Fortune 500 and government clients, they deliver a combination of technology-driven solutions and expert management to enhance real-time security across diverse organizational landscapes.