Advanced Analysis Detection Engineer

Secureworks (NASDAQ: SCWX) is a global cybersecurity leader that secures human progress with Secureworks® Taegis™, a SaaS-based, open XDR platform built on 20+ years of real-world threat intelligence and research, improving customers’ ability to detect advanced threats, streamline and collaborate on investigations, and automate the right actions.

We enjoy competitive compensation and benefits packages, and reward and recognize our employees for exceptional results. A constant focus on continued learning and growth keeps our team members engaged and excited about “what’s next.” We offer flexible work options when available, and emphasize the importance of work-life balance. We know that when our people are rewarded, recognized, and rejuvenated, we win as a team.

Role Overview

The CTU Senior Advisor will be responsible for performing detail-oriented work that involves security threat analysis of various malware and web attacks across the entire Secureworks’ landscape and introducing those learnings into the Taegis platform. You will display advanced knowledge of the Taegis Platform, backend and workflow processes. Your focus is to ensure an optimal and constantly improving signal:noise alert ratio is being presented to our analysts and clients.

The successful candidate must be a strong practitioner in the security field with proven technical skills and experience researching, hunting for, and responding to advanced threat actors. This candidate will possess skills to create and maintain high fidelity detections. As a member of a highly trained security research team – The Counter Threat Unit (CTU™) - the candidate will contribute technical leadership for client-focused projects, generate high-confidence threat detection, and contribute to the development of advanced technologies and processes to detect threat actors, enhancing protections for our Taegis customers.

Role Responsibilities are as follows:

• Security Alert Efficacy Tuning and Optimization
  • Research and efficacy improvements for alerts sourced from the expansive Taegis device integrations (network, cloud, endpoint, etc.)
  • Provide an optimal signal:noise ratio for our analysts and clients, performing consistent review of alerts and events.
• New Device Ingestion Alert Handling Research/Implementation
  • Research and understand multiple security devices to implement an alert handling policy that reflects sending high impact alerts to our clients and analysts.
  • Tactic Graphs creation to differentiate our native ingestions from standard device monitoring deployment.
  • Consistent review of previously handled alerts, updating severity based on platform context and OSINT.
• Contribute to the development and delivery of competitive services, methodologies, and deliverables in the security marketplace.
• Contribute to the development and delivery of internal tooling, technologies and processes.
• Serve as a subject matter expert in key elements of the practice other departments, including marketing, product management, and the broader Counter Threat Unit research team.

Requirements

• Knowledge, understanding, and practical experience in the following areas:
  • Taegis environment backend
  • Endpoint hunting and analysis
  • Linux/Unix and Windows operating system navigation and administration, working from the command line
  • Identifying exploits, vulnerabilities, and network attacks
  • Advanced regular expressions
  • Database queries and structures
  • Improving SOC workflow and processes
  • Computer architecture and operating systems concepts
• Data Analysis and Programming
  • Scripting PowerShell, Bash, Python and foundational programming skills.
  • Hands on Experience with popular Python data science packages such as Numpy, Pandas, and Matplotlib.
  • Familiarity with CI/CD pipelines, testing and automation.
• Network traffic analysis
  • Identifying detectable traits of threat network traffic
  • Broad analysis of traffic patterns to identify anomalies
• Event log analysis
  • Inspection of log data from common operating systems and security infrastructure to identify threat activity and piece together an incident
  • Analysis of log data from security infrastructure (firewalls, web proxy etc.) to identify anomalous patterns of behavior
• Strong passion for learning new technology and concepts quickly

Education, Experience & Credentials

Typically requires 8+ years of related experience in a professional role with a Bachelor’s degree; or 6+ years with a Master’s degree; or 3+ years with a PhD; or equivalent experience

GSEC, GCIA, GPEN, GWAPT, GCIH, GSEC, OSCP, OSCE, or equivalent certifications

Secureworks is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment. All employment decisions at Secureworks are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate. Secureworks will not tolerate discrimination or harassment based on any of these characteristics.