Senior Detection and Response Engineer, Altruist

• Experience - 4+ years of experience in detection engineering, incident response, or threat hunting:
• Hands-on authoring of detections in a modern SIEM
• Investigations across cloud (AWS), endpoint, and identity data sources
• Comfort scripting and automating (e.g., Python)
• Strong ability to work independently
• Education - A B.A. / B.S. degree in relevant fields such as Computer Science or Computer Engineering or Information Security or relevant experience
• Technical aptitude - You’re technologically savvy and can easily get up to speed on modern tech stacks (i.e., AWS, Kubernetes, Datadog/Splunk, SentinelOne, CrowdStrike, Terraform, etc.)
• Ownership - The pride you put into every aspect of your work is unparalleled and undeniable
• Superb communication - Intentional dialogue is a superpower. You listen as well as you share your perspective with others
• Resilience - We’re inspired by your unwavering determination to achieve success, no matter the adversity you face along the way
• Assurance - Your confidence is brilliant, yet ego-less. You possess a strong knowledge base, the ability to discover the unknown, and are open to differing perspectives
• Creative problem solving - Identifying the problem is simply not enough. You’re instinctually creative with your approach in finding solutions to roadblocks

Desirable

• Altruist is in the midst of an exciting phase and we’re excited to hire a Senior Detection and Response Engineer to join our growing Security team. You’ll build the detections and response capability that find and stop threats across our cloud, endpoints, and identity providers
• Build, tune, and maintain high-fidelity detections as code across SIEM, cloud, endpoint , and identity telemetry
• Triage and investigate alerts, lead response on security incidents, and proactively threat-hunt for “low and slow” and insider activity
• Operationalize threat intelligence and IOC ingestion into detections and edge/WAF rules
• Develop response playbooks and automation (SOAR) to reduce toil and speed containment
• Partner with our MDR and IR partners and run purple-team exercises with our red team security engineers
• Continuously improve logging coverage and detection efficacy, measured against MITRE ATT&CK