The Role
Investigate email-security detections across Proof of Value accounts, analyze phishing, BEC, malware delivery, and evasion techniques, reconstruct verdict paths, and quantify detection trends. Classify threats, identify emerging attacker campaigns, correlate findings with threat intelligence, triage customer and SOC feedback, and recommend detection improvements. Use SQL, Python, analytics, and AI tools to automate analysis and communicate concise, evidence-based findings to product and engineering teams.
Summary Generated by Built In
About the client
Our client is a leading global cybersecurity company that protects organizations across their people, their data and the AI systems they rely on. It serves tens of thousands of customers worldwide and analyzes billions of security events every day to stop attacks before they cause harm.
About the role
We are looking for two Detection Engineering Analysts to join the client's Product Management organization, reporting to the Manager of Detection Engineering. You will help keep detection ahead of attackers, spotting shifts in technique early and making sure every Proof of Value (POV) shows what the product can do.
Your analysis is the foundation for product decisions. You will own each investigation from first signal to evidenced finding and hand it to Product Management quantified, classified and ready to act on, while product leadership owns prioritization and the roadmap. You will work daily with threat research, detection engineering, customer success, support, POV engineers and sales. The role draws on security operations analyst skills, but sits in Product Management: you investigate and recommend, and detection engineering teams build the changes.
What you'll do
Proof of Value success
- Monitor active POVs and fine-tune each account to its environment so every POV shows the full strength of the detection.
- Log your changes and share patterns with detection engineering.
- Use product analytics to identify prospects with unusual traffic or threat profiles, and work with POV engineers and sales to provide efficacy evidence.
Trend analysis and threat mapping
- Classify each case against the detection taxonomy, map it to its delivery vector and detection layer, and flag new candidate categories.
- Track detection performance over time by category and layer, keeping trend views usable by non-analysts.
- Identify campaign clusters and emerging attacker techniques across accounts, and escalate them as single findings rather than a queue of tickets.
- Correlate trend data with external threat intelligence, internal threat research and competitive evaluations.
- Use AI tools to speed up classification, analysis and reporting.
Detection feedback and improvement
- Triage feedback from security operations, customer success and support, and resolve configuration and expected-behavior cases independently.
- Investigate and reproduce reported cases, reconstruct verdicts across the detection chain and quantify their impact.
Why join
- Sit where threat research, engineering and product meet, with early sight of how attackers are changing their approach.
- A direct line to the people who decide what gets built next.
- A globally distributed team that values data-led decisions, direct communication and owning outcomes.
- Formal and on-the-job learning with cross-functional teams.
Requirements
Required
- Proven experience as a security analyst in email security, a SOC or threat research, ideally at a product or security vendor.
- Strong working knowledge of phishing, business email compromise (BEC), malware delivery and evasion techniques.
- Hands-on email analysis: header and payload inspection, URL and attachment analysis, and an understanding of how scanners reach a verdict.
- Log analysis and the ability to reconstruct a verdict path across a layered detection chain.
- Comfort with data: querying large datasets with SQL or equivalent to measure impact, recurrence and trends, plus scripting in Python or similar to automate analysis.
- Clear written communication: turning a messy investigation into a short, quantified finding that engineers and product leaders can act on.
- Sound judgment on which findings warrant a detection change.
- Curiosity about how attackers build and evolve campaigns, and how AI tools can make analysis faster.
- Advanced English.
Nice to have
- Building AI-assisted analyst workflows, such as LLM-driven triage, classification or reporting.
- IOC extraction and campaign clustering.
- Experience with POVs or pre-sales technical evaluations.
- Familiarity with product analytics tools and with ticketing, knowledge-base and collaboration tools.
Benefits
- Permanent contract (contrato a término indefinido) with all legal benefits
- Competitive salary
- Private health insurance (medicina prepagada)
- Formal and on-the-job learning with global, cross-functional teams
- On-site job with parking
Skills Required
- Proven experience as a security analyst in email security, a SOC, or threat research, ideally at a product or security vendor.
- Strong working knowledge of phishing, business email compromise, malware delivery, and evasion techniques.
- Hands-on email analysis, including header and payload inspection, URL and attachment analysis, and understanding scanner verdicts.
- Log analysis and ability to reconstruct verdict paths across layered detection chains.
- Ability to query large datasets with SQL or equivalent and use Python or similar scripting for analysis automation.
- Clear written communication for producing concise, quantified findings actionable by engineers and product leaders.
- Sound judgment about which findings warrant detection changes.
- Curiosity about attacker campaigns and use of AI tools to accelerate analysis.
- Advanced English proficiency.
- Experience building AI-assisted analyst workflows, including LLM-driven triage, classification, or reporting.
- IOC extraction and campaign clustering experience.
- Experience with Proofs of Value or pre-sales technical evaluations.
- Familiarity with product analytics, ticketing, knowledge-base, and collaboration tools.
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Roca Alliances is a consulting agency dedicated to helping global companies build geographically diverse teams and scale their operations by outsourcing or nearshoring to Latin America. With over 15 years of expertise, the company utilizes a proprietary approach to analyze, assess, and identify ideal locations across the Americas, fostering growth and scalability for clients in various industries including technology, media, and marketing.
