Threat Detection Researcher - Google SecOps

Threat Detection Researcher

Reporting to the Manager, Threat Detection Research, the Threat Detection Researcher will participate in cybersecurity detection strategy, creation, tuning, validation, and correlation to ensure that Deepwatch customers have effective detections in place against an ever-changing threat landscape. Deepwatch Threat Detection Researchers perform a wide array of tasks in an effort to increase Deepwatch’s detection capabilities, detection fidelity, and ensure Deepwatch is able to effectively detect and respond to cyber threats. 
Threat Detection Researchers play a key-role in researching and developing  new detection capabilities and refining existing detection capabilities for Deepwatch’s customers. Through these detection capabilities, Threat Detection Researchers will have a direct impact on Deepwatch’s  ability to effectively detect and respond to security threats 

In this role, you’ll get to:

• Evaluate current monitoring and detection capabilities to identify areas for improvement
• Manage detection capabilities to ensure appropriate coverage, effective operation, and adherence to deepwatch standards
• Detection Research
• Detection Creation
• Detection Tuning
• Assist in the development of Deepwatch’s detection strategy, researching new threats, technologies and developing new detections
• Research and assist in the design of risk based detection mechanisms 

To be successful in this role, you’ll need:

• Experience with Google SecOps / Yara-L
• Cybersecurity experience in a technical role or experience working in a SOC/MDR/MSSP
• Ability to engineer creative, scalable, and out-of-the-box solutions
• Stay up to date with cybersecurity best practices, security technology trends, tools, and frameworks
• Experience working with and creating detections for SIEM tools and/or EDR platforms 
• Understanding of common enterprise technologies and logging capabilities including Cloud, IDS/IPS, Firewalls, Active Directory, Anti-Virus/EDR, Proxies, and Email Gateway
• Understanding of various attack frameworks such as MITRE ATT&CK and general adversarial / defensive security techniques (e.g. the Cyber Kill Chain, and NIST)
• Ability to communicate and document technical information effectively towards various audiences
• Experience working with version control systems to facilitate documentation of detection signatures
• Understanding of Threat Actors and their corresponding TTPs
• Ability to translate forensic and threat intelligence reports into detection capabilities
• Experience working with lab environments and simulation tools to test detection efficacy
• Understanding of sigma/yara as a detection framework

Statutory Pay Disclosure

The anticipated salary range for this role is $130,00 to $150,000 + stock options + benefits. Actual compensation may vary from posted hiring range based upon geographic location, work experience, education, and/or skill level.

ITAR Compliance 

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.;
• A lawful permanent resident of the United States; 
• A person admitted to the United States as a refugee; or
• A person that has been granted asylum by the United States government.

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.