XSIAM Detection Engineer

Summary

Join Red Canary's XSIAM Detection Engineering & Response team as a Detection Engineer, working a 24/7 schedule to identify and mitigate cyber threats. You will configure and manage a Security Information and Event Management (SIEM) system, investigate security alarms, automate solutions using scripting, and develop advanced detectors. This role requires hands-on experience in SIEM administration, scripting, and large enterprise environments. You will leverage your security operations expertise to enhance the team's knowledge base and create customer-facing playbooks. Red Canary offers a competitive salary, bonus program, stock options, and a comprehensive benefits package.

Requirements

• 1+ years experience working hands-on in Information Security SIEM administration, parser development, cybersecurity content development, creating queries, alerting, and log analysis (or similar analysis role)
• 1+ years experience in scripting/process automation
• 1+ years experience operating and supporting a large enterprise environment
• Experience with security configuration of operating systems, network devices, etc
• Demonstrated experience with at least one programming/scripting language
• Demonstrated experience in understanding networking technologies and protocols
• Demonstrated systems administration experience with Windows and Linux/UNIX-based operating systems
• Participated in an on-call schedule responsible for responding to high-priority issues
• Must have a passion for technology and stay current with emerging security trends
• Excellent verbal & written communication and presentation skills

Responsibilities

• Use Palo Alto’s XSIAM platform, source signal data, and external resources to uncover threats and tell the story of what occurred in a customer environment
• Build new detection capabilities into the XSIAM platform based on your research of new attack techniques
• Leverage previous security operations experience to enhance the XSIAM Detection Engineering & Response teams knowledge-base and expertise
• Initiate and undertake tasks of writing XQL logic in the XSIAM platform to improve operational workflows
• Create and tune customer facing playbooks for SOAR functionality
• Configure a Security Information and Event Management (SIEM) system for our customers
• Investigate and triage alarms related to relevant security data/threats/events
• Write scripts to automate solutions for alarms and threats from enterprise systems
• Write and tune advanced detectors and correlation rules to identify threats in customers’ environments

Preferred Qualifications

• Experience with Palo Alto XSIAM (or next-gen SIEM)
• Experience with EDR technologies
• Familiarity with standard logs from different systems: Windows/Linux/Cloud, etc
• Advanced scripting – Python, Go, Javascript

Benefits

• 100% Paid Premiums: Red Canary offers a 100% paid plan option for medical, dental and vision for you and your dependents. No waiting period
• Health & Wellness - Access to mental health services, Employee Assistance Program and additional programs to incentivize healthy habits
• Fertility Benefits: All new hires are eligible for benefits as of their first day
• Flexible Time Off: Take the time you need to recharge including vacation, sick, bereavement, jury duty, and holidays
• Paid Parental Leave- Full base pay to bond/care for your new child
• Pre-Tax Plans - Red Canary offers a variety of plans to fit you and your dependent specific needs including FSA, HRA and HSA, with employer funding to offset out of pocket health care expenses
• Flexible Work Environment- With 60% remote workforce, Canaries can work virtually from almost anywhere in the US
• Targeted base salary range: $95,400 - $118,000
• This role is eligible for participation in the company's bonus program
• This role is also eligible for a grant of stock options, subject to the approval of the company's board of directors