Note: The job is a remote job and is open to candidates in USA. Dice is hiring a Senior Security Automation and Detection Engineer for a long-term contract role. The position focuses on logging infrastructure, security detection engineering, SIEM/SOAR platforms, automated response workflows, integrations, and security monitoring.
Responsibilities
- Experience with deploying log pipeline solutions (e.g., Bindplane, Cribl, Databahn, forwarder agents) and troubleshooting performance
- Experience using webhooks and an understanding of common cloud & security tooling platforms such as AWS, Azure, Microsoft Defender, Crowdstrike, and more
- Experience using and/or understanding security logs, understanding the difference between security and operational logs, and the fields that matter from a security perspective within security logs
- Ability to understand common logging formats (syslog, JSON, KV, CEF, etc.)
- Experience with creating parsers to normalize log data from disparate formats, ensuring that downstream security needs are met
- Ability to create monitoring/health dashboards across a variety of solutions for scenarios such as silent log sources
- Ability to author and tune risk based alerts and machine based learning techniques (beyond what platforms natively support such as XSIAM or Google SecOps)
- Experience in leading SIEM technologies such as Google SecOps or Palo XSIAM
- Experience in upstream tools with detection suites like CrowdStrike, MSFT Defender, Wiz, Proofpoint, Obsidian
- Experience in leading SOAR platforms such as Google SecOps SOAR, Palo Alto XSOAR (Demisto), Swimlane, Splunk SOAR (Phantom), etc
- Ability to design, build, and maintain automated playbooks/workflows that orchestrate detection, enrichment, and response actions
- Ability to build and maintain custom integrations/connectors (Python, REST APIs) to extend platform functionality beyond out-of-the-box content
- Experience building and maintaining scheduled Jobs (recurring/batch automation independent of case-triggered playbooks)
- Ability to build custom HTML widgets/visual reporting tied to automation and case data
- Experience with the marketplace/content ecosystem - evaluating, deploying, and customizing pre-built integrations vs. building from scratch
Skills
- Experience with deploying log pipeline solutions (e.g., Bindplane, Cribl, Databahn, forwarder agents) and troubleshooting performance
- Experience using webhooks and an understanding of common cloud & security tooling platforms such as AWS, Azure, Microsoft Defender, Crowdstrike, and more
- Experience using and/or understanding security logs, understanding the difference between security and operational logs, and the fields that matter from a security perspective within security logs
- Ability to understand common logging formats (syslog, JSON, KV, CEF, etc.)
- Experience with creating parsers to normalize log data from disparate formats, ensuring that downstream security needs are met
- Ability to create monitoring/health dashboards across a variety of solutions for scenarios such as silent log sources
- Ability to author and tune risk based alerts and machine based learning techniques (beyond what platforms natively support such as XSIAM or Google SecOps)
- Experience in leading SIEM technologies such as Google SecOps or Palo XSIAM
- Experience in upstream tools with detection suites like CrowdStrike, MSFT Defender, Wiz, Proofpoint, Obsidian
- Experience in leading SOAR platforms such as Google SecOps SOAR, Palo Alto XSOAR (Demisto), Swimlane, Splunk SOAR (Phantom), etc
- Ability to design, build, and maintain automated playbooks/workflows that orchestrate detection, enrichment, and response actions
- Ability to build and maintain custom integrations/connectors (Python, REST APIs) to extend platform functionality beyond out-of-the-box content
- Experience building and maintaining scheduled Jobs (recurring/batch automation independent of case-triggered playbooks)
- Ability to build custom HTML widgets/visual reporting tied to automation and case data
- Experience with the marketplace/content ecosystem - evaluating, deploying, and customizing pre-built integrations vs. building from scratch
Company Overview
Company H1B Sponsorship