Principal Threat Detections Engineer
Dragos Inc., Canada

Responsibilities

• Identify and prioritize new data sources and their applicability to the detection of advanced adversaries.
•  Generate innovative threat behavior analytics for discovering historical and emerging threats to industrial networks and devices.
•  Generate innovative threat behavior analytics for discovering historical and emerging threats to industrial networks and devices.
•  Write scripts to build attack simulation scenarios and supporting infrastructure, to validate and improve Dragos Platform detection.
•  Develop detection strategies based on internal and external intelligence reporting, vulnerability research, and red team techniques.
•  Within internal datasets, hunt for threats to aid in threat discovery and detection development.
•  Using internally developed and open source detections, manage platform detection coverage and effectiveness against potential threats.
•  Develop and maintain more advanced detections, including threat behavior, configuration, and modeling analytics, using internal/custom detection engines.
•  Utilize internal dataset to validate and improve detections.
•  Liaison with other internal departments to aid with detection engine development, protocol analysis, and asset identification.
•  Review detection-related material in outgoing reports.
•  Ensure that all documents, workflows, and processes remain accurate and up-to-date.

Requirements

• Advanced understanding, working knowledge of common open source detection tools (Yara, Snort, Zeek, Suricata, Python, GO) used to develop detections.
• Working knowledge of MITRE ATT&CK and Kill Chain Frameworks.
•  8+ years of information security experience working as a SOC analyst, security content developer, and/or security engineer.
• The ability to design and implement Continuous Integration development programs for detection content.
• Technical point of contact and company-wide expert for high visibility projects, responding to product manager, engineering, and non-technical colleague requests for information.
• Ability to understand systems quickly and translate understanding into logic to detect anomalies within the system.
• Proficient to expert level working knowledge of Network Intrusion Detection systems and developing capabilities in their respective platforms.
• Experience working with geographically dispersed teams and customers.
• Excellent interpersonal skills and ability to see things through the customer’s eyes yet still able to speak authoritatively and confidently while balancing respect and tact.
• Draw from your industry expertise in understanding how an attacker would behave and translate it to custom behavioral detection content.

Nice to Have

• Working knowledge of a low-level language [C, C++, etc.).
• Experience with industrial control systems/operational technologies and its networking protocols.
• Work experience within a cyber threat intelligence environment.
• Advanced data analytics or working knowledge of artificial intelligence.  

Job Rewards and Benefits