Detection Engineer

Build, test and deploy detection analytics based on research of novel attack techniques and real world threats to Box.

Work closely with our Incident Response Teams to improve the fidelity, context and automation of new and existing alerting.

Identify and assist service owners with logging configuration to eliminate gaps in logging visibility.

Work closely with our Red Team to identify and develop solutions for gaps in detection coverage.

Participate in Purple Team exercises to improve and validate detections.

Work closely with our Intelligence Team to focus detection efforts on prioritized threat behaviors.

Participate in after hours on-call rotation when required

Shift work may be required to support stakeholders in the US

A Bachelors degree in computer science, cybersecurity, mathematics, data science or related fields, or equivalent work experience.

4+ years of experience in a security operations role. 

You are comfortable (and enjoy!) searching through TB's of data in a SIEM to find interesting patterns (i.e. Splunk, ELK, etc.).

You are familiar with Splunk Processing Language (SPL) or SQL and want to become a power user.

You have worked as an incident responder or have partnered closely with an incident response team.

You are comfortable writing small scripts in python or similar scripting languages.

You have an understanding of how attackers leverage commonly used MITRE ATT&CK techniques and common ways to detect them.

You are familiar with reviewing logs from various Operating Systems (MacOS, Linux, Windows) and cloud infrastructures.