Senior Cyber Security Engineer, Stack AV

• Experience working with and managing Security Information and Event Management (SIEM) tools such as Splunk, Sumo Logic, Elastic, etc
• Threat hunting experience endpoint, network, DNS, email, EDR, and audit logs, as well as netflow and packet captures
• Experience working with and managing utilizing Endpoint Detection and Response (EDR) tools such as Crowdstrike, Sentinel One, Microsoft Defender, etc
• Thorough understanding of MacOS, Linux, and Windows hardening and security best practices
• Experience creating threat and DLP signatures for network, endpoint, email, and cloud/SaaS security solutions to identify potential attacks, exploits, or data exfiltration attempts
• Extensive experience developing and automating incident response policies
• Experience delivering complex projects, including coordinating and driving issues to resolution utilizing excellent technical troubleshooting skills
• A drive to learn and work with industry leading technologies
• An understanding of network orchestration and automation with Python, Ansible, and Terraform. Any experience automating security operations tasks or using SOAR platforms is a plus
• Experience with DevSecOps practices, including securing containerization technologies (Kubernetes, Docker, etc), artifact repositories (Artifactory, CodeArtifact, etc), and CI/CD or version control systems (GitHub, GitLab, etc)

Desirable

• The Cyber Security team itself is responsible for securing Stack AV’s environment, including on-prem and cloud resources, remote users, data, and the vehicles themselves
• The Cyber Engineering role at Stack AV is responsible for developing and maintaining new threat detection capabilities, triaging and tuning security events and incidents, and leading security investigations and incident response efforts
• The primary focus of this will be developing threat detection capabilities and responding to security incidents involving Stack’s infrastructure, data, and users across private cloud, public cloud, SaaS, on-prem, and remote user environments
• Develop new cyber detections for threats and other uses cases using our SIEM and other security tooling
• Develop automated processes for triaging security incidents and incident response in general
• Assesses software and service requests from within the organization
• Deploy and develop solutions to better secure Stack AV’s infrastructure, data, and people
• Conduct and/or arrange vulnerability and other security assessments on Stack’s infrastructure
• Respond to security incidents and drive the effort to mitigate and/or remediate findings