Senior Detection Engineer

Verizon•Ashburn, VA

2d•Hybrid

About The Position

The GN&T Network Security team is looking for a highly motivated and experienced Security Engineer with expertise in security detections, EDR systems and data engineering to join the Network Security Foundational team. Successful candidates will be able to apply their expertise in the design, and implementation of cutting-edge and mission critical security detections used to detect and mitigate sophisticated threats facing Verizon and our customers. The Network Intelligence infrastructure consists of several large scale compute and storage clusters that are used to analyze petabyte scale network and security event data sets for anomalous and malicious network activity. As a Security Engineer on our team, you won't just be monitoring dashboards; you will be the architect of our detection strategy and the primary defender of our infrastructure and global network. In this role, you will be an owner of our Endpoint Detection and Response (EDR) ecosystem and our SIEM visibility. You will be expected to anticipate how an adversary thinks, build the systems to catch them, and lead the technical discussions when high-stakes incidents occur.

Requirements

Bachelor’s degree in Computer Science, Cybersecurity, or a related field or four or more years of work experience.
Four or more years of relevant experience required, demonstrated through one or a combination of work and/or military experience, or specialized training.
Extensive background in overseeing EDR/XDR detections on a large scale.
Experience managing Linux systems, including deep knowledge of the boot process, PAM, and persistence mechanisms.
Advanced knowledge of networking protocols (BGP, TLS/SSL, DNS).
Expert knowledge in developing scripts and writing programs (e.g. Python) to automate tasks and solve problems.
Advanced knowledge of database systems, the relational database model and hands-on expertise working with data.
Extensive experience in a dedicated security engineering or incident response role, with a track record of defending enterprise-scale environments.

Nice To Haves

Expert-level knowledge of Splunk SPL. You should be capable of building custom macros, data models, and automated lookups to streamline investigations.
Understanding of attack and mitigation strategies, including telemetry required for blocking or detection.
Hands-on experience with CrowdStrike Falcon (including RTR and Fusion) and Splunk ES is highly preferred.
Strong analytical skills and attention to detail with a proven track record of managing and delivering results.
Leadership experience as a subject matter expert with effective written, interpersonal, and verbal communication skills.

Responsibilities

Design, build, and optimize advanced security detections within the Splunk platform.
Serve as the global SME for our CrowdStrike environment. This includes managing large-scale deployments, tuning prevention policies, and performing deep-dive forensic analysis on endpoint telemetry.
Work primarily on linux-based systems developing detections and investigating EDR-based alerts and detections.
Analyze, normalize and utilize data to identify certain security patterns and properties.
Build small programs and scripts to solve problems and automate tasks to allow the team to move faster and be more efficient.