Senior Threat Detection and Response Engineer - Philippines

Job description

About Cloudtrace Founded in 2018, Cloudtrace specialises in providing offensive and defensive cyber security services for public cloud environments. Our service offerings include penetration testing, red/purple teaming, 24/7 managed security services, PCI DSS QSA assessments and incident response. Cloudtrace is a PCI Security Standards Council (SSC) Qualified Security Assessor Company (QSAC), a CREST accredited penetration testing provider and ISO 27001 certified by the British Standards Institution (BSI). Amazon Web Services (AWS) has designated Cloudtrace as an Advanced Tier Services partner with the Level 1 Managed Security Services Provider Competency and recognised us as the 2024 AWS Rising Star Consulting Partner of the Year for Australia and New Zealand. Our Values Customers are our compass: Our customers drive our decision-making processes. We are dedicated to our mission of protecting them and work backwards from that. We get things done: When we work on something we own it. We love solving difficult challenges and we never make excuses. We know time is valuable and we don’t waste it. We are constantly learning: Our team is passionate about what we do and are hungry for knowledge. It excites us that the work we do lets us learn more every day. We are creators: There is always a better way and we are obsessed with continually improving how we do things. Invention is in our DNA and we are all about rewriting the rules. We take pride in our work: If a job’s worth doing its worth doing well. We pay attention to detail, deliver quality and encourage each other to be the best at what we do. Why Join Us Here's why passionate cyber professionals choose to work with us: We make a real difference: The work we do directly protects the global community from cybercriminals, making the digital world a safer place. We are at the forefront of innovation : Our customers are some of the brightest stars in technology and we work closely with them to secure their cloud-native platforms. We are shaping the future of threat detection: We are crafting a cloud-native threat detection service that changes the way modern application environments are protected. We unlock potential with continuous learning : We invest in career growth with training programs, attendance at security conferences, and mentorship from cloud security experts. We are a collaborative fast-paced team: Our team is made up of experts in the industry who share a passion for cyber security and building innovative technology. The Role We are looking for a technical lead to join our fast-growing Threat Detection and Response (TDR) team and help us forge a next-generation cloud native managed security service. This role would suit someone currently in a senior security operations or DevOps role that is looking to take the next step in their career and become an expert in cloud security. Our philosophy is that solid defense requires intimate knowledge of offensive tactics. Our managed security service leverages our penetration testing and red team expertise to ensure our TDR team is across current cyber-attack techniques. This, combined with our cloud-native tooling and deep understanding of AWS services, allows us to deliver best-in-class protection for AWS customer environments. The successful candidate will work closely with our experienced offensive security and incident response teams to understand the latest TTPs used in real world breaches. That knowledge will be used to continually improve our next generation threat detection service and protect our customers from cyber-attacks. Cloudtrace customers include start-ups, scale-ups, enterprises and state/federal government agencies, giving this role exposure to a range of technologies and industry sectors. Your Responsibilities Our in-house SIEM platform, built on Amazon Security Lake, ingests telemetry from AWS services, endpoint security products and third-party SaaS vendors. You be working with our team to continuously improve the detection and investigation capabilities of the platform. You will use findings from our offensive team engagements and MITRE ATT&CK® Matrices to detect the latest threat IOCs and TTPs used by highly skilled adversaries. You will be responding to alerts generated by our SIEM platform and investigating complex attack chains to ensure breaches are rapidly discovered and contained. Using penetration testing techniques, you will also validate any security exposures detected by our Attack Surface Management (ASM) platform and review the security of new customer assets identified by the platform discovery engine. Your Typical Day This is not a typical SOC role where you wait for SIEM alerts to come through, you will be constantly applying your current skillset across different areas and learning new skills every day. A typical day will include enhancing the capabilities of our TDR service, using exploit POCs to validate real cyber threats, and giving security advice to customers in shared slack channels. Your daily activities will include the following: Investigating and responding to potential cyber threats Ownership through to resolution of alerts generated by our SIEM and ASM platforms Liaising with customers to provide updates on alert investigation status Escalating to our offensive security team for validation of complex exposures Closing alerts with investigation outcomes once appropriate action has been taken Review of new assets discovered by our ASM platform and assessing exposure risk Developing high signal threat detection rules Tuning existing rules to reduce false positive rates Developing new rules to search and alert on threat activity Engaging our offensive security team for rule testing Managing a best-in-class cloud TDR solution Updating event ingestion pipelines to enrich data for threat detection rules Monitoring CloudWatch metrics and modifying AWS service configurations as required Reviewing OpenSearch metrics and modifying index configurations as required Developing and maintaining runbooks that improve our threat detection processes Automation of routine tasks such as filtering low-priority alerts and sending notifications You will also be using your client facing and engineering skills to work collaboratively with the broader team on projects and periodic reporting. These activities will include: Assistance with onboarding of new clients to our TDR and ASM platforms Integration of new log sources for existing TDR clients Generation of reports for our managed service clients Presentation of report content to our managed service clients Your Experience You will need 5+ years’ experience in the following areas: Cyber security operations covering endpoints and cloud services Tuning SIEM rules for accurate threat detection Your Skills The following base technical skills are required for this role: Endpoint Security Understanding of endpoint cyber threats and attack vectors including: Malware (e.g. Ransomware) Adversary in the Middle Attacks Network Protocols Understanding of common internet protocols, including: TCP/IP HTTP DNS TLS AWS Configuration of basic AWS services via console and CLI, including: EC2 Instances Security Groups IAM Permissions Data Analysis Ability to write data queries using syntax such as SQL, DSL, KQL or ES|QL Ability to extract relevant data in spreadsheets using formulas and functions Linux Command line navigation and file operations Scripting for automation using Bash and Python The following non-technical skills are required for this role: Clear communication of technical information to both technical and non-technical audiences Problem solving and critical thinking to approach problems from different angles and identify potential solutions Ability to independently find information from internet resources and use that to solve complex problems Strong organisational skills with the proven ability to meet deadlines in a fast-paced environment Ability to make quick decisions under pressure, weighing risks and benefits to choose the best course of action Ability to interpret data, identify patterns, and draw conclusions from complex information