- Canberra, ACT
- Full-Time
- 24 days ago
Detection and SOAR Engineer, Mandiant Consulting, Google Cloud.
Before you go
Before you leave us, sign up for our email alerts
We don't do job spam, just the best digital jobs delivered straight to your inbox.
Detection and SOAR Engineer, Mandiant Consulting, Google Cloud: our view in 3 lines...
- The Role:This role is for a detection and SOAR engineer supporting cyber defense operations at Mandiant Consulting within Google Cloud.
- The Person:The person will improve Cyber Defense Centers, advise client SOC and CSIRT teams, create SIEM use cases and Python SOAR playbooks, and maintain SIEM and SOAR platform readiness.
- Requirements:The ideal candidate has a bachelor's degree in a related technical field or equivalent practical experience, three years of experience in detection engineering or SOAR automation, and experience with SIEM solutions, Python or Powershell, and certifications such as CISSP.
About the role
Minimum qualifications:
- Bachelor's degree in Computer Science, Information Systems, Cybersecurity, a related technical field, or equivalent practical experience.
- 3 years of experience in detection engineering, SOAR automation, or a related role.
- 3 years of experience working with SOC/CSIRT or other incident response related teams.
- Experience with detection tuning and creation leveraging various security tools (e.g., SIEM, EDR, or NDR tools).
- Experience with scripting Security Information and Event Management (SIEM) solutions (e.g., writing queries, searches, alerts, dashboards) in Python or Powershell.
Preferred qualifications:
- Certifications in one or more of the following: CompTIA Security+, CompTIA Network+; CISCO (CCNA); ISC2 (CISSP); SANS (GSEC, GCIH, GCED, GCFA, GCIA, GNFA, GPEN).
- Experience with SOAR and its dependencies, managing and maintaining SOAR platforms, as well as integrating APIs into automation playbooks.
- Experience with content engineering inside SIEM platforms (e.g., rule creation, advanced correlation searching, etc.).
- Experience with SPL, KQL, YARA-L or similar SIEM query languages, with an understanding of SIEM log flow, aggregation, and forwarding.
- Understanding of logging for common platforms and devices, including Linux and network equipment.
About the job:
In this role, you will collaborate with multiple cross-functional teams like Mandiant Architects, Mandiant Analysts, Client Information Technology (IT) resources, and other business resource owners. You will be responsible for enabling the technology and tools required to effectively accomplish daily tasks within a Cyber Defense Center (CDC). This includes maintaining operational readiness of the client Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) platform, creating detection content and automations to support the daily tasks within the CDC. In addition, you may be responsible for setting appropriate configurations of the SIEM and SOAR or related response technologies required for a client's SOC to maintain effective incident detection and response capabilities.
Responsibilities:
- Identify challenges in customer Cyber Defense Centers (CDC) and formulate strategies for improvement, plan implementation of improvements, and execute/oversee plans to completion.
- Advise on technologies relied upon by the client CDC, Computer Security Incident Response Team (CSIRT), and SOC.
- Create and modify SIEM use cases written in both technology specific query language and Sigma open signature format. Create and modify SOAR playbooks written in Python.
- Engage and collaborate with client stakeholders and other groups within customer environment to drive resolution for security issues.
- Provide expertise for SIEM, SOAR and other SOC technologies that assist in incident response.