Senior Security Analyst I

Detection engineering and threat hunting inside infrastructure security, owning critical parts of the monitoring programme rather than working an alert queue. Building detections, measuring whether they work, and improving the response function around them.

Most security monitoring programmes cannot say whether they are getting better, and the metrics responsibility is the part of this posting that tries to fix that. US remote, Python and Bash on Linux with SIEM work. Cloud provider detection means the environment is enormous and the adversaries are often the company's own customers.