Detection and Response Engineer

🕒 Julho 24

🇺🇸 Estados Unidos – Remoto (EUA)

💵 $100.000 - $145.000 / ano

⏰ Tempo Integral

🟡 Pleno

🟠 Sênior

👷🏻‍♀️ Engenheiro

🦅 Patrocina Visto H1B

Esta empresa já patrocinou vistos H1B no passado.

👻 Score fantasma 11%

O que significa: quão provável esta vaga está aberta sem contratação ativa.Como ler: 60% ou mais significa que achamos que é uma vaga fantasma. Pontuações mais baixas preocupam menos.Como pontuamos: tempo em aberto, republicações, vagas abertas vs tamanho do time, rapidez para fechar vagas, e se o salário está divulgado.Observação: é uma estimativa de dados públicos, não um julgamento da empresa. Vagas reais podem ter pontuação alta, então use como uma dica, não como um fato.

Candidatar-se

Encontrar Vagas Remotas Similares

Configurar Alerta de Email para Novas Vagas

📊 Verifique sua pontuação de currículo para esta vaga

Melhore suas chances de conseguir uma entrevista verificando sua pontuação de currículo antes de se candidatar.

Enviar Currículo

North

SiteLinkedInTodas as Vagas

1001 - 5000 funcionários

💼 Consultoria

🏥 Saúde

📦 Logística

Consulting • Healthcare • Logistics

A North é um fornecedor abrangente de soluções de pagamento. Especializando-se em sistemas de ponto de venda, processamento de pagamentos e serviços para comerciantes, a North oferece uma ampla gama de produtos para otimizar as operações de negócios, tanto online quanto offline. Seus serviços incluem pagamentos móveis seguros, gateways de e-commerce, soluções de POS e ferramentas de back-office como faturamento, relatórios, gerenciamento de estoque e programas de fidelidade do cliente. A North atende diversos setores, incluindo varejo, restaurantes, saúde, jogos e mais, com soluções robustas adaptadas às necessidades específicas de negócios. Eles oferecem opções escaláveis para empresas e franquias e fornecem APIs para que os desenvolvedores criem soluções de pagamento integradas. Comprometida com a segurança, a North garante que todas as transações sejam validadas pelo PCI DSS, com criptografia avançada e tokenização.

Descrição

• Design, build, and tune detection content across endpoint, network, cloud, and identity log sources • Perform coverage and gap analysis against MITRE ATT&CK and actual log source volume • Validate detection logic against real-world attack techniques and reduce false-positive rates • Maintain and version-control the detection rule repository, including coverage documentation and known gaps • Triage, investigate, and contain security incidents and alerts • Conduct root cause analysis and structured post-incident reviews • Document incident timelines, indicators of compromise, and remediation actions • Support forensic investigations of compromised hosts, accounts, and applications • Participate in an on-call rotation for critical incident response as needed • Evaluate, pilot, and implement AI/LLM-powered tools for alert triage, enrichment, and analyst workflows • Build and tune AI-assisted investigation and detection workflows to reduce analyst workload and MTTR • Identify high-value AI and automation use cases and measure impact • Apply human validation to AI-generated output where necessary, especially for high-confidence detections and containment actions • Develop SOAR, script, and API-based automation for detection, enrichment, and response workflows • Automate repetitive SOC and incident response tasks, including evidence gathering, enrichment, and ticketing • Build and maintain playbooks and runbooks for common incident types • Write and maintain Python or similar scripts integrating security tools and data sources • Partner with cloud, network, and identity teams to close visibility and telemetry gaps • Stay current on threat intelligence, adversary TTPs, and vulnerabilities relevant to payments/fintech • Communicate findings, coverage gaps, and recommendations to technical and non-technical stakeholders • Develop and maintain procedure and policy documentation supporting detection and response operations

🎯 Requisitos

• Bachelor's degree in a technical field, or equivalent professional experience • 3–5 years of hands-on information security experience, with demonstrated depth in at least two of: detection engineering, incident response, security automation, or SOC operations • Hands-on experience writing, tuning, or maintaining detection content in a SIEM or NG-SIEM platform, such as CrowdStrike NG-SIEM, Splunk, or Microsoft Sentinel • Experience with EDR/XDR platforms and log analysis across endpoint, network, cloud, and identity sources • Working knowledge of the MITRE ATT&CK framework and practical application to detection engineering and gap analysis • Scripting or automation experience using Python, PowerShell, or similar applied to security use cases and/or experience using LLM coding tools such as Claude Code, Gemini CLI, or Codex • Solid understanding of networking, cloud infrastructure (AWS especially, plus Azure and GCP), Windows/Linux systems, and identity platforms • Working knowledge of PCI-DSS or a comparable compliance framework • Excellent written and verbal communication skills, including translating technical findings for non-technical stakeholders • Applicants located in the East and Central time zones receive preferred consideration • Must be eligible to work in the United States; no current or future sponsorship available • Certifications including GCIH, GCFA, OSCP, OSIR, CompTIA CySA+, or CompTIA CASP+ are nice to have, but not required • Relevant hands-on experience is weighted more heavily than certifications • SOAR platform experience, such as N8N or Tines, is beneficial • Experience integrating or building with LLM/AI APIs for security use cases is beneficial • Experience with cloud-native security tooling, threat intelligence platforms, digital forensics, purple team/adversary emulation, and payments/fintech regulatory environments is beneficial

🏖️ Benefícios

• Total rewards offerings • Benefits supporting overall well-being • Unique personally and professionally fulfilling initiatives • Diverse and inclusive work environment