Sr. Security Engineer - Threat Research

ExtraHop is seeking a Senior Security Engineer experienced in threat detection and networking to join their world-class Threat Research team. The ideal candidate will have a strong understanding of the attack lifecycle and a deep desire to stop attackers before they can cause damage. Responsibilities include analyzing and reproducing network-based cyber attacks, communicating research findings, mentoring less experienced engineers, and improving analysis and detector development processes. Required skills include a degree or equivalent experience in cyber security or related fields, experience in penetration testing and vulnerability exploitation, knowledge of network security and protocols, and proficiency in tools like Wireshark and Python.

• Reproduce and analyze network-based cyber attacks, including vulnerability exploitation and lateral movement.
• Communicate research findings in writing to detection engineering and collaborate in writing detectors to detect cyber attacks.
• Mentor and teach less experienced security engineers about cyber attacks, malware analysis, vulnerabilities research, or other areas of expertise.
• Work with management and other team members to improve analysis and detector development processes.
• Have a strong understanding of the attack lifecycle and a deep desire to stop attackers before they can do damage.
• Possess a Bachelor's degree or equivalent experience in cyber security, computer science, engineering, or network forensics.
• Have experience in penetration testing, red teaming, or capture the flag competitions that include hands-on execution of attacks and vulnerability exploitation.
• Be experienced in writing or working with signatures (Suricata or Snort) or machine learning intended to detect network-based cyber attacks.
• Have a strong understanding of network security and networking basics, including the OSI model and excellent working knowledge of the key protocols from Layer 2 through Layer 7, including IP, TCP, UDP, and HTTP.
• Have good communication skills with the ability to clearly communicate in writing technical details about attacks.
• Possess strong working experience in using Wireshark, TShark, or other network analysis tools.
• Have strong working experience with Python or equivalent scripting languages.
• Have 3 years of professional experience as a Threat Researcher, Penetration Tester, or Vulnerability Researcher (desired).
• Be familiar with MITRE's ATT&CK Framework (desired).
• Be familiar with VM and container technologies for setting up ephemeral environments for research (desired).
• Be familiar with Windows protocols and reconnaissance and lateral movement techniques in Windows environments (desired).
• Have knowledge of various signature frameworks, including YARA, ClamAV, JA3, and JARM (desired).

• Bachelor's degree or equivalent experience in cyber security, computer science, engineering, or network forensics
• Experience in penetration testing, red teaming, or capture the flag competitions that include hands-on execution of attacks and vulnerability exploitation
• Experience in writing or working with signatures (Suricata or Snort) or machine learning intended to detect network-based cyber attacks
• Strong understanding of network security and networking basics, including the OSI model and excellent working knowledge of the key protocols from Layer 2 through Layer 7, including IP, TCP, UDP, and HTTP
• Good communication skills with the ability to clearly communicate in writing technical details about attacks
• Strong working experience in using Wireshark, TShark or other network analysis tools
• Strong working experience with Python or equivalent scripting languages
• 3 years of professional experience as a Threat Researcher, Penetration Tester, or Vulnerability Researcher (desired)
• Familiarity with MITRE's ATT&CK Framework (desired)
• Familiarity with VM and container technologies for setting up ephemeral environments for research (desired)
• Familiarity with Windows protocols and reconnaissance and lateral movement techniques in Windows environments (desired)
• Knowledge of various signature frameworks, including YARA, ClamAV, JA3, and JARM (desired)

• Health, dental, and vision benefits
• Honor System PTO and 9 Holidays (US only) + 3 Days of Paid Volunteer Time
• Non-Commissioned positions are eligible to participate in annual discretionary bonus plan
• FSA and Dependent Care Accounts + EAP where applicable
• Educational Reimbursement
• 401k with employer match or Pension where applicable
• Pet Insurance (US only)
• Parental Leave (US Only)
• Hybrid and Remote Work Model