Security Detection & Response Engineer
COMPANY OVERVIEW
ThreatLocker® is a global cybersecurity leader, providing enterprise-level cybersecurity tools for the Managed Services Provider (MSP) industry to improve the security of servers and endpoints. ThreatLocker’s combined Application Whitelisting, Ringfencing™, Storage Control and Privileged Access Management solutions are leading the cybersecurity market towards a more secure approach of blocking unknown application vulnerabilities.
Job Summary:
The Security Detection & Response Engineer is responsible for identifying, investigating, and responding to cyber threats, vulnerabilities, and security incidents across the organization’s systems and networks. This role focuses on proactive monitoring and quick response to security events to protect the organization's data and critical infrastructure. The ideal candidate has strong technical skills in threat detection, security monitoring, and incident response.
Key Responsibilities:
Threat Detection and Monitoring:
- Monitor security tools and systems (SIEM, IDS/IPS, EDR, etc.) for suspicious activity or breaches.
- Analyze security alerts and data to identify potential threats, vulnerabilities, and compromises.
- Build and refine detection capabilities using security tools, threat intelligence, and machine learning models.
Incident Response:
- Lead and participate in the response to security incidents (investigating, containing, eradicating, and recovering from threats).
- Collaborate with cross-functional teams to develop incident handling processes and ensure timely remediation.
- Create detailed post-incident reports, including root cause analysis and recommendations for improvements.
Security Tool Development & Automation:
- Develop automated tools and scripts to enhance security detection capabilities and streamline threat detection workflows.
- Maintain and enhance detection tools, including writing custom SNORT, SIGMA, and YARA rules, and updating rulesets in accordance with new threats.
Security Investigations:
- Conduct forensic analysis and threat hunting to identify malicious activity.
- Review logs from various systems (e.g., firewalls, servers, network devices) to uncover unauthorized activities.
- Research and stay current on emerging threats, vulnerabilities, and cyber-attack techniques.
Continuous Improvement:
- Contribute to the enhancement of security monitoring tools, processes, and playbooks.
- Develop automated scripts and tools to improve detection and response efficiency.
- Work closely with DevOps, Network, and Security Engineering teams to ensure secure architectures and systems.
Threat Intelligence:
- Leverage internal and external threat intelligence sources to stay informed about the latest security trends and threats.
- Share insights with internal stakeholders to ensure proactive measures are in place.
Compliance & Reporting:
- Ensure security processes and procedures align with regulatory requirements and industry best practices (e.g., NIST, CIS, ISO 27001).
- Assist in the preparation of audit reports and security assessments.
Key Skills & Qualifications:
Education:
- Bachelor’s degree in information security, Cybersecurity, Computer Science, or a related field (or equivalent experience).
Experience:
- 3+ years of experience in a security-focused role, preferably in detection, monitoring, or incident response.
Technical Skills:
- Strong familiarity with SIEM tools, EDR tools, and IDS/IPS systems.
- Knowledge of network security technologies and protocols (TCP/IP, DNS, VPNs, firewalls, etc.).
- Proficiency in scripting languages such as Python, PowerShell, or Bash.
- Proficiency in custom SNORT, SIGMA, and YARA rule creation.
- Understanding of malware behavior, attack vectors, and vulnerability exploitation techniques.
Certifications (Preferred):
- GIAC Certified Intrusion Analyst (GCIA)
- GIAC Security Essentials Certification (GSEC)
- Certified Information Systems Security Professional (CISSP)
- Certified Ethical Hacker (CEH)
- OffSec Certified Professional (OSCP)
- CompTIA Certs
- Security +
- Network +
- Pentest +
- CASP+
Soft Skills:
- Excellent analytical and problem-solving abilities.
- Ability to work under pressure and manage multiple detection initiatives simultaneously.
- Strong written and verbal communication skills, with an ability to present technical concepts clearly.
- Detail-oriented with the ability to quickly assess security issues and provide appropriate remediation actions.
