Detection and Response Engineer

🕒 vor 14 Tagen

🇺🇸 Vereinigte Staaten – Remote

💵 $100.000 - $145.000 / Jahr

⏰ Vollzeit

🟡 Mittelstufe

🟠 Senior

👷🏻‍♀️ Ingenieur

🦅 H1B-Visum-Sponsor

Dieses Unternehmen hat in der Vergangenheit H1B-Visa gesponsert.

Jetzt Bewerben

Ähnliche Remote-Jobs finden

E-Mail-Benachrichtigung für neue Jobs einrichten

📊 Überprüfen Sie Ihre Lebenslauf-Bewertung für diese Stelle

Verbessern Sie Ihre Chancen auf ein Vorstellungsgespräch, indem Sie Ihre Lebenslauf-Bewertung vor der Bewerbung überprüfen.

Lebenslauf hochladen

North

WebsiteLinkedInAlle Stellen

1001 - 5000 Mitarbeiter

💼 Beratung

🏥 Gesundheitswesen

📦 Logistik

Consulting • Healthcare • Logistics

North ist ein umfassender Anbieter von Zahlungslösungen. Spezialisiert auf Kassensysteme, Zahlungsabwicklung und Händlerdienste bietet North eine breite Palette von Produkten, um Geschäftsabläufe sowohl online als auch offline zu optimieren. Ihre Dienstleistungen umfassen sichere mobile Zahlungen, E-Commerce-Gateways, POS-Lösungen und Back-Office-Tools wie Rechnungsstellung, Berichterstattung, Bestandsmanagement und Kundenbindungsprogramme. North unterstützt vielfältige Branchen, darunter Einzelhandel, Gastronomie, Gesundheitswesen, Gaming und mehr, mit robusten Lösungen, die auf spezifische Geschäftsbedürfnisse zugeschnitten sind. Sie bieten skalierbare Optionen für Unternehmen und Franchise-Nehmer und stellen APIs für Entwickler bereit, um integrierte Zahlungslösungen zu schaffen. Engagiert für die Sicherheit stellt North sicher, dass alle Transaktionen PCI DSS-validiert und mit fortschrittlicher Verschlüsselung und Tokenisierung versehen sind.

Beschreibung

• Design, build, and tune detection content (rules, correlation searches, use cases) across endpoint, network, cloud, and identity log sources • Perform ongoing coverage and gap analysis against the MITRE ATT&CK framework and actual log source volume, prioritizing based on real attack surface • Validate detection logic against real-world attack techniques from cyber threat intelligence and reduce false-positive rates without sacrificing efficacy • Maintain and version-control the detection rule repository, including documentation of coverage and known gaps • Triage, investigate, and contain security incidents and alerts across the environment • Conduct root cause analysis and structured post-incident reviews, feeding findings back into detection engineering • Document incident timelines, indicators of compromise, and remediation actions • Support forensic investigation of compromised hosts, accounts, and applications • Participate in on-call rotation for critical incident response as needed • Evaluate, pilot, and implement AI/LLM-powered tools for alert triage, enrichment, and analyst workflows • Build and tune AI-assisted investigation and detection workflows to reduce analyst workload and mean time to respond (MTTR) • Identify high-value use cases for AI and automation while measuring the resulting impact • Apply sound judgment about where AI-generated output requires human validation, particularly for high-confidence detections and containment actions • Develop automation and orchestration (SOAR, scripts, APIs) to streamline detection, enrichment, and response workflows • Automate repetitive SOC and IR tasks, such as evidence gathering, enrichment, and ticketing, to reduce manual toil • Build and maintain playbooks and runbooks for common incident types • Write and maintain scripts (Python or similar) that integrate security tooling and data sources • Partner with cloud, network, and identity teams to close visibility and telemetry gaps • Stay current on threat intelligence, adversary TTPs, and vulnerabilities relevant to a payments/fintech environment • Communicate findings, coverage gaps, and recommendations clearly to both technical and non-technical stakeholders • Develop and maintain procedure and policy documentation supporting detection and response operations.

🎯 Anforderungen

• Bachelor's degree in a technical field, or equivalent professional experience • 3–5 years of hands-on information security experience, with demonstrated depth in at least two of: detection engineering, incident response, security automation, or SOC operations • Hands-on experience writing, tuning, or maintaining detection content in a SIEM or NG-SIEM platform (e.g., CrowdStrike NG-SIEM, Splunk, Microsoft Sentinel) • Experience with EDR/XDR platforms and log analysis across diverse sources: endpoint, network, cloud, and identity • Working knowledge of the MITRE ATT&CK framework and its practical application to detection engineering and gap analysis • Scripting or automation experience (Python, PowerShell, or similar) applied to security use cases AND/OR experience using LLM coding tools such as Claude Code, Gemini CLI, or Codex. • Solid understanding of networking, cloud infrastructure (AWS especially, but also Azure and GCP), Windows/Linux systems, and identity platforms • Working knowledge of PCI-DSS or a comparable compliance framework • Excellent written and verbal communication skills, including the ability to translate technical findings for non-technical stakeholders.

🏖️ Vorteile

• Health insurance • 401(k) retirement plans • Paid time off • Flexible work arrangements • Professional development opportunities