Senior Threat Detection Analyst

WHAT YOU’LL DO:

As a Senior Detection Engineer at Kaseya, you'll be on the cutting edge of cybersecurity, tasked with researching, building, and maintaining high-confidence detection logic for our security monitoring products. You’ll dive deep into the latest cyber threats, malware, and adversary techniques, then apply that research to build detection rules and analytics that keep our customers protected. You’ll collaborate with security product teams, validate detection logic, and serve as a senior technical resource during active incident responses. If you love working with complex security problems and are passionate about developing detection solutions that can stop adversaries in their tracks, this is the role for you!

WHAT WE ARE LOOKING FOR:

We’re looking for a seasoned detection engineer with a deep understanding of malware analysis, adversary tactics, and detection engineering. You’ll report to the Director of Security Operations and work closely with other security teams to ensure Kaseya's security products have the most effective detection capabilities in the industry. The ideal candidate will bring a strong foundation in computer networking, cyber operations, and detection engineering, combined with the drive to build and improve security tools that help customers mitigate advanced threats.

ESSENTIAL DUTIES AND RESPONSIBILITIES:

• Threat Research: Conduct in-depth research into the latest malware and adversary tactics, techniques, and procedures (TTPs) to stay ahead of emerging threats.
• Detection Logic Development: Build, tune, and maintain detection analytics, rules, and countermeasures for our security products, including Endpoint Detection and Response (EDR).
• Simulate Attacks: Perform adversary attack simulations to validate detection logic and improve detection accuracy and efficiency.
• Collaborate with Product Teams: Work closely with security product teams to identify coverage gaps and areas for improving detection within Kaseya’s security offerings.
• Incident Response Support: Serve as a senior technical resource to Security Operations Centers (SOC) during active response efforts, providing expertise on detection capabilities and how they can be used to thwart adversaries.

WHAT YOU’LL BRING:

• Experience:
  • At least 5 years working in networking administration and computer networking.
  • A minimum of 2 years working in cyber operations, including SIEM and EDR monitoring, triage, incident response, threat hunting, and forensics.
  • 2+ years of hands-on experience developing detection analytics, SIEM/EDR rules, and related content.
• Cybersecurity Knowledge:
  • Familiarity with common malware families and adversary Tactics, Techniques, and Procedures (TTPs), especially frameworks like MITRE ATT&CK™.
  • General knowledge of Windows, Linux, and macOS operating system internals.
• Technical Proficiency:
  • Proficiency in using regex and SQL query languages.
  • Experience using offensive testing tools like Cobalt Strike, Mimikatz, Metasploit, or Atomic Red Team (a nice-to-have).

DESIRED SKILLS:

• Education: A Bachelor's degree or equivalent IT work experience.
• Threat Hunting & Data Analytics: Working knowledge of threat hunting and data analytics tools like Elastic, Athena, Snowflake, or other SQL-based databases.
• Scripting Skills: Proficiency with scripting languages like Bash, PowerShell, and Lua (nice-to-have).
• Incident Response Experience: Experience in Digital Forensics and Incident Response (DFIR).
• Certifications: One or more of the following certifications would be a plus: GCFA, GCFE, GREM, GNFA, or OSCP.