Threat Detection Engineer Who We Are Legato Security is an information security firm founded upon the belief that every organization has the right to keep its data private and secure. Our mission is to build close partne…
Skills: Threat detection, SIEM, Sumo Logic, Google SecOps, Stellar Cyber
Sign up with Clera and we'll reach out the moment a role actually fits you — no more spraying applications into the void.
Full-time
bachelor degree
Medical benefits, Dental benefits, Short-term disability, Life insurance, Children's orthodontia, Flexible paid time off
Posted 6d ago
~40 hrs/week
Responsibilities
The Detection Engineer will create, tune, and review detection rules across various SIEM platforms while collaborating with SOC analysts to improve detection accuracy. They will also maintain documentation, assist with infrastructure projects, and contribute to detection-as-code initiatives.
Requirements
Candidates must have a bachelor's degree in a relevant field and 3-5 years of experience in detection engineering or a related cybersecurity role. Strong knowledge of networking, Windows OS, and Active Directory fundamentals is required.
Full job description
Threat Detection Engineer
Who We Are
Legato Security is an information security firm founded upon the belief that every organization has the right to keep its data private and secure. Our mission is to build close partnerships with our clients, serving them not as just a vendor, but as trusted advisors helping to build effective, proactive plans. Our focus is always on both the technical and human elements within an organization. We believe in comprehensive strategies designed to harden networks, deflect attackers, and rapidly recover from any accidents. As technology progresses, so do our tactics, ensuring our experts are always prepared to serve forward-looking leaders eager to stay ahead of emerging threats.
Position Overview
Legato Security is seeking a motivated junior or mid-level Detection Engineer to assist with detection engineering efforts. As a Detection Engineer, you will assist with rule creation, rule tuning, creating documentation, assisting with on-going infrastructure projects, and assisting with customer requests.
Specific Job Responsibilities
Create, improve, review, and tune detection rules in various SIEMs (e.g., Sumo Logic, Google SecOps, Stellar Cyber). This will include log reviews of customer environments to make informed decisions.
Assist in creating and maintaining documentation for detection procedures, workflows, and active projects.
Collaborate with SOC analysts to improve detection accuracy and reduce false positives
Help maintain and update detection use cases based on emerging threats and customer-specific logs.
Assist in creating regular reports on detection metrics and effectiveness.
Review and respond to internal and customer requests to assist with anything related to detection engineering.
Contribute to declarative and imperative programming projects to assist with detection as code.
Qualifications
Required Qualifications:
Bachelor's degree in Computer Science, Cybersecurity, related field or equivalent industry experience
3-5 years of experience in detection engineering or a related field (e.g., SOC Analyst, Pen Testing, IT Infrastructure, Network Engineering, or Software Development). Job-specific experience in detection engineering is not required
Familiarity with networking principals (e.g. routing, common protocols, firewall functionality, etc.)
Basic understanding of Windows operating systems (e.g. versions, common exploits, understanding of registries, exposed protocols, common enumeration commands, etc.)
Active Directory Fundamentals (e.g. basic understanding of NTLM and Kerberos, how to use LDAP, understanding of common attacks within Active Directory.)
Understanding of Detection as Code and common exploits
Strong interest in pursuing a career in detection engineering
Ability to quickly learn different tool sets and environments
Strong written and verbal communication skills
Ability to prioritize multiple competing projects, meet deadlines, and work effectively in a team environment
Preferred Qualifications:
Applicants who demonstrate personal learning and curiosity through personal projects will be prioritized. e.g. home labs, personal Github projects, write-ups, blog posts, Hack the Box profile, TryHackMe profile.
Relevant certifications such as OSCP (Offsec), OSDA (Offsec), CPTS (HTB), CDSA (HTB), etc.
Perks
·Start-up company in a growth phase with opportunity for advancement based on performance
·Start-up culture with an office in downtown Salt Lake City, UT
·Competitive medical and dental benefits for employee and family members
·Other voluntary benefits such as short-term disability, life insurance, children’s orthodontia, with additional voluntary benefits available
·Flexible Paid Time Off policy
·Professional Development opportunities specific to role
Related keywords
Threat DetectionSIEMSumo LogicGoogle SecOpsStellar CyberCybersecurityNetworkingWindowsActive DirectoryNTLMKerberosLDAPDetection as CodeSOC AnalystPen TestingOSCP
With our 24x7 Security Operations Center, we secure your data and employees so you can focus on your business.
Industry
Computer and Network Security
Company size
51-200 employees
Founded
2020
Headquarters
Salt Lake City, Utah
LinkedIn followers
2,881
Our mission is to provide comprehensive, customer-centric managed cyber security services that effectively manage and mitigate cyber risks on behalf of our customers. We continually adapt and innovate our services to stay ahead of emerging threats and evolving technologies, delivering peace of mind and enabling our customers to focus on their core business objectives. With a team of dedicated experts and cutting-edge technologies, we strive to build trusted partnerships, deliver exceptional value, and safeguard our customers' digital assets with unwavering commitment.
Offices: 10 W 100 S, Third Floor, Salt Lake City, Utah 84101, US
With our 24x7 Security Operations Center, we secure your data and employees so you can focus on your business.
Industry
Computer and Network Security
Company size
51-200 employees
Founded
2020
Headquarters
Salt Lake City, Utah
LinkedIn followers
2,881
Our mission is to provide comprehensive, customer-centric managed cyber security services that effectively manage and mitigate cyber risks on behalf of our customers. We continually adapt and innovate our services to stay ahead of emerging threats and evolving technologies, delivering peace of mind and enabling our customers to focus on their core business objectives. With a team of dedicated experts and cutting-edge technologies, we strive to build trusted partnerships, deliver exceptional value, and safeguard our customers' digital assets with unwavering commitment.
Offices: 10 W 100 S, Third Floor, Salt Lake City, Utah 84101, US