Sr. Security Engineer - Threat Research

We are ExtraHop . We’re on a mission to provide security teams with the intelligence they need to confront and stop advanced threats like supply chain attacks zero day exploits and ransomware attacks. Attackers still have the advantage. We’re taking it back with creativity intellectual curiosity and a sense of humor. Are you ready to help us reclaim the upper hand?

Do you like securing complex networks? Want to be a part of a collaborative team that builds solutions that protect some of the biggest networks in the world? ExtraHop is seeking a Senior Security Engineer experienced with threat detection and networking to grow our world-class Threat Research team.

We are looking for a self-starter that enjoys investigating cyber attacks and how adversaries are traversing the network for lateral movement. You must have a strong understanding of the attack lifecycle and a deep desire to stop attackers before they can do damage.

Duties & Responsibilities

• Reproduce and analyze network-based cyber attacks including vulnerability exploitation and lateral movement.

• Communicate in writing research findings to detection engineering and collaborate in writing detectors to detect cyber attacks.

• Mentor and teach less experienced security engineers about cyber attacks malware analysis vulnerabilities research or other areas of expertise.

• Work with management and other team members to improve analysis and detector development processes.

Required Skills & Experience

• Bachelor’s degree or equivalent experience in cyber security computer science engineering or network forensics.

• Experience in penetration testing red teaming or capture the flag competitions that include hands-on execution of attacks and vulnerability exploitation.

• Experience in writing or working with signatures (Suricata or Snort) or machine learning intended to detect network-based cyber attacks.

• Strong understanding of network security and networking basics including the OSI model and excellent working knowledge of the key protocols from Layer 2 through Layer 7 including IP TCP UDP and HTTP.

• Good communication skills with the ability to clearly communicate in writing technical details about attacks.

• Strong working experience in using Wireshark TShark or other network analysis tools.

• Strong working experience with Python or equivalent scripting languages.

Desired Skills & Experience

• 3 years of professional experience as a Threat Researcher Penetration Tester or Vulnerability Researcher.

• Familiarity with MITRE’s ATT&CK Framework.

• Familiarity with VM and container technologies for setting up ephemeral environments for research.

• Familiarity with Windows protocols and reconnaissance and lateral movement techniques in Windows environments.

• Knowledge of various signature frameworks including YARA ClamAV JA3 and JARM.

All R&D Employees will be required to attend 2 mandatory in-person events every year of approx. 4 days duration.

$136000- $180000 + benefits

Applicants must be authorized to work for ANY employer in the U.S.  We are unable to sponsor or assume sponsorship of an employment Visa at this time.

#LI-CS1

#remote