Threat Detection Engineer, Cybereason
Cybersecurity platform
Job no longer available
Cybersecurity platform
501-1000 employees
Job no longer available
501-1000 employees
Company mission
To empower enterprises, organizations, and businesses to run their operations with full security confidence.
Role
Who you are
- 4+ years+ of relevant experience in the cybersecurity industry, particularly in the areas of detection engineering, red/blue teaming, cyber threat groups, existing attack methods and their resulting log patterns
- 4+ years + of experience with query syntax and usage, particularly those applying to log files (Splunk, YARA-L, OPAL, SQL, etc) - simple and complex joins and aggregations
- Foundational understanding of computer networking and modern computer architecture/operating systems
- Familiarity with network and security control products (firewalls, auth systems, MFA, cloud) and vendor and industry standard event logging formats (syslog, CEF, etc)
- Working knowledge MITRE ATT&CK, Lockheed Martin’s Cyber Kill Chain frameworks
- Background and experience in at least 3 of 6 areas is required:
- Cyber Threat Intelligence - OSINT, Dark Web, or research
- Digital Forensics & Incident Response (DFIR)
- Detection Engineering (in support of EDR/XDR/MDR platforms)
- SOC operations and analysis
- Malware analysis & reverse engineering
- Penetration Testing and/or Red Team
- Demonstrable problem-solving and analytical thinking capabilities
- Attention to detail
- Ability to manage competing priorities and work efficiently under pressure
- Experience with a query language
- Preference for candidates with Terraform experience
- Preference for candidates with Observe OPAL experience
- Preference for candidates with experience interfacing with external customers
- Motivated to constantly improve processes and methodologies
- Self-starting and capable of leading and completing assignments without supervision
- Excellent interpersonal, verbal & written communication skills
- Ability to work both independently as well as on a team. Comfortable working in remote work environments with a globally distributed team in multiple countries
- Ability to mentor others; proactively collaborates and shares knowledge
What the job involves
- As a Threat Detection Engineer you will be instrumental in the creation, testing, tuning and deployment of threat detections, evaluating their security value, analysing and assigning the detection to the MITRE attack framework, and streamlining the delivery of security services across the entire scope of our company
- You will be required to communicate complex detection capabilities to both technical teams and non-technical senior executives and customers, making your ability to translate intricate technical details into clear, understandable terms a vital asset to our team
- Create and research new ways to tie event telemetry together in new and valuable ways
- Develop, debug and deploy detections
- Continually find ways to streamline processes and re-use of code
- Parse various types of log events into standardized formats regardless of the availability of vendor documentation
- Find creative ways to correlate events that are otherwise indirect
- Produce detection and process documentation
- Collaborate with Global SOC, IR and product related teams on progress or issues
- Perform open source intelligence (OSINT) collection and analysis, identifying relevant indications of cyber threats, malicious code, malicious websites, and vulnerabilities
- Work to ingest disparate data sources to enrich existing detection set
- Provide mentoring and collaboration with other team members
- Key Performance Indicators (KPIs)
- Sense of urgency for high priority deliverables
- Quality and standardization of code
- Impact of contributions to Cybereason Security Services performance in the form of improvements to:
- Detection deployment timelines
- Enrichment and tuning of detections, increasing quality
- Demonstration of creativity and security value
- Adaptability to new processes and technologies
Our take
Cybereason is a cybersecurity endpoint detection and response platform that identifies cyber attacks. The defense platform leverages antivirus, detection and response technology with pre-emptive threat hunting to make clients future-ready against cyber attacks.
While there are a number of companies operating in this space, Cybereason has a strong track record, having helped protect customers such as Motorola, Mitsubishi and Harrods from supply-chain attacks as well as a series of high-profile ransomware attacks like those launched by DarkSide, REvil and Conti groups.
Despite a strong customer base and attracting a high level of investment, Cybereason hasn't been immune to macroeconomic conditions which have affected the overall tech sector, and it carried out a large scale restructuring near the end of 2022. After receiving Series G funding in 2023, Cyberason is expanding its customer base in the US midmarket segment and optimizing its product until market conditions turn around.
Kirsty
Company Specialist at Welcome to the Jungle
Insights
-31% employee growth in 12 months
Company
Funding (last 2 of 9 rounds)
Mar 2025
$120m
LATE VC
Apr 2023
$100m
SERIES G
Total funding: $933.6m
Company benefits
- Unlimited PTO
- Health, Dental & Vision
- Snacks + Beverages (in office)
- Employee Assistance Program
- Fitness Reimbursement
- Pension/401k
Company HQ
Prudential / St. Botolph, Boston, MA
Leadership
Yossi Naar
(Chief Visionary Officer)They worked as a Software Developer for 10 months before spending a combined 6 years at Gita Technologies and Kenshoo. They co-founded Cybereason in 2012.
Share this job