Endpoint Detection Engineering Manager
Endpoint Detection Engineering Manager
Employer Active
Job Alert
You will be updated with latest job alerts via email
Share
Job Alert
You will be updated with latest job alerts via email
Job Description
Line of Service
AssuranceIndustry/Sector
TechnologySpecialism
RiskManagement Level
ManagerJob Description & Summary
About the role
PwCs Global Threat Intelligence and practice is seeking a detection engineer and threat hunter who has a passion and aptitude for developing behavioural techniques and analytics to detect adversary behaviour in enterprise IT networks.
The team focuses on the identification of novel intrusion techniques and tracking of several hundred threat actors ranging from organised crime groups to state affiliated espionage actors originating from more than 25 countries.
What your days will look like:
Joining the detection engineering team within PwCs Global Threat Intelligence practice you will lead research and engineering efforts for novel blue team and threat hunting techniques with endpoint cloud and network telemetry and develop and refine our bespoke detection content libraries for XDR solutions (such as Microsoft Defender XDR Palo Alto Networks Cortex XDR and Tanium Threat Response) and intrusion detection systems (such as Suricata). You will work closely with threat research and incident response teams investigating attacker activity in the wild red teams seeking to develop new techniques and managed services teams deploying your content into client environments where you will also work with telemetry for testing purposes.
Roles and responsibilities:
Work closely with our threat intelligence analysts to build detection coverage for techniques leveraged by the threat actors that the Global Threat Intelligence team tracks
Utilize selfdriven approaches leveraging OSINT reporting as well as threat hunting in XDR and SIEM platforms to identify new opportunities for detection content
Build automations and integrations which interface with XDR SIEM and EDR products to facilitate evaluation of content in development as well as onboarding of production detection content with PwCs clients
Find opportunities to drive efficiency in detection rule production through automating repetitive tasks and identifying workflow improvements
Provide defenderoriented perspectives to threat intelligence analysis and reporting advising on mitigations detections and other defensive measures to action identified threat actor techniques
Engage with cyber advisory functions across the PwC network (such as managed cyber defense incident response and red team functions) on utilizing detection content and occasionally advise clients on best practices for threat hunting & detection
This role is for you if:
You have strong experience writing and tuning detection rules that are deployed at scale in an enterprise network setting either within an organization or in a managed SOC environment
You have strong familiarity with the internals of operating systems such as installation persistency enumeration and authentication mechanisms in particular for Windows
You have experience working with version control systems (git) associated collaborative review processes and build pipeline technologies (e.g. Google CloudBuild Jenkins CircleCI GitHub Actions)
You have experience responding to security incidents with a demonstrated understanding of how defenders respond to security breaches and mitigate threats
You have high familiarity with the MITRE ATT&CK framework and how it maps to TI research and detections
You have robust awareness of the current cyber threat landscape including current threat actors both financially motivated and APTs as well as key malware families and trends in threat actor techniques
You are proficient in writing Python code to bestpractice production standards for commandline applications build pipelines and interfacing with APIs
Education (if blank degree and/or field of study not specified)
Degrees/Field of Study required:Degrees/Field of Study preferred:Certifications (if blank certifications not specified)
Required Skills
Optional Skills
Accepting Feedback Accepting Feedback Active Listening Analytical Thinking Cloud Security Coaching and Feedback Communication Conducting Research Creativity Cyber Defense Cyber Threat Intelligence Embracing Change Emotional Regulation Empathy Encryption Inclusion Information Security Intellectual Curiosity Intelligence Analysis Intelligence Report Intrusion Detection Intrusion Detection System (IDS) IT Operations Learning Agility Malware Analysis 21 moreDesired Languages (If blank desired languages not specified)
Travel Requirements
Up to 20Available for Work Visa Sponsorship
YesGovernment Clearance Required
NoJob Posting End Date
Required Experience:
Manager
Employment Type
Full-Time
