Detection Research Engineer

The Detection Research Team is responsible for delivering products that will improve the detection capabilities of IronDefense and inform internal teams, customers, and the public about threats in the current landscape. A detection research engineer focuses on building and improving our data collection platforms and transforming the data into useful information.  The information produced will be used to improve the IronDefense platform.

Responsibilities

• Collecting, processing, curating and enriching data - providing a continuous flow of data to researchers and data scientists.
• Develop and maintain new and existing data sources.
• Develop and maintain data enrichment pipelines and the process used to curate and validate collected data.
• Develop and maintain data collection components of the team’s infrastructure and the tools used to aggregate the collected data.
• Develop signature and heuristic-based detection rules to aid behavioral and outlier analytics.
• Work with data scientists and data engineers to extract information from collected data.

Requirements

• Build tools to perform data collection, parsing, and analysis from a variety of data sources
• Experience building and maintaining honeypots
• Extracting malware samples from honeypots and network collection
• Experience with data analysis tools
• Understand and identify common attack vectors
• Understand network protocols and common ways they are employed in attacks
• Hands-on programming/scripting experience and the ability and willingness to learn new languages as needed
• Can work independently
• 3+ years in one or more of the following roles: incident response, intrusion analysis, threat intelligence or a role performing the majority of the responsibilities listed above
• 3+ years of programming experience
• minimum of 1 year of OT experience (preference 3+ years OT experience)

Desirable Qualifications

• 5+ years in one or more of the following roles: incident response, intrusion analysis, threat intelligence or a role performing the majority of the responsibilities listed above
• 5+ years of programming experience
• Experience using threat intelligence tools and platforms
• Experience using browser automation tools