Security Engineer

Who You Are

You are a cybersecurity professional with several years of experience working in a security operations center. You have hands-on experience with security tools like SIEM, SOAR, EDR, and IDS and applying these tools to defend an organization against modern threats. You are familiar with cybersecurity frameworks like NIST CSF and CIS as well as compliance certifications like ISO 27001 and PCI DSS 4.0. You are self-motivated and passionate, able to identify and action on areas of improvement with minimal oversight. You have an intimate knowledge of cyber threats and remain plugged into the threat landscape, staying up to date on trends and adversarial activity. You’re a great communicator, able to explain complex technical topics to non-technical individuals. You are proficient in Python, able to automate repetitive tasks and create custom integrations between security tools.

The Opportunity

WatchGuard is growing its internal security operations organization to combat evolving cyber threats with an expanded Computer Security Incident Response Team (CSIRT). This team is instrumental for maintaining overall trust and risk management within WatchGuard. As a global cybersecurity vendor, at WatchGuard you’ll have ample opportunity to use the latest technologies and defend against the most sophisticated threats.

Responsibilities

1. Help shape WatchGuard’s cybersecurity strategy as a member of the Security Operations Center.
2. Maintain business continuity through incident response activities, shaping corporate security policy, and deploying preventative controls.
3. Develop detection use cases and respond to alerts generated by those use cases.
4. Join CSIRT’s 12-hour on-call rotation for security incident escalations to guide incident response activities and reduce mean time to containment.
5. Stay up-to-date on the latest attacker techniques and defender strategies.
6. Automate activities wherever possible to succeed in your role.

A Day in the Life

As a member of the Security Operations Center at WatchGuard, no two days will ever be the same. Every day you will help review and investigate security events, proactively threat hunt for indicators of compromise, and help improve WatchGuard’s security controls and policies. As a member of the CSIRT organization, you will make a meaningful impact on WatchGuard’s security posture, identifying and closing gaps in our controls and automating repeated tasks. Throughout the day, you’ll remain plugged into security news and threat intelligence feeds, using your knowledge to help WatchGuard defend against emerging threats.

Within One Month, You Will...

1. Become familiar with WatchGuard’s security policies and controls.
2. Begin investigating security events and proactively threat hunting across WatchGuard’s global networks.

Within Three Months, You Will...

1. Share your knowledge by writing and improving playbooks.
2. Identify areas for improvement across WatchGuard security operations and propose actionable solutions.
3. Drive automation throughout the security organization to improve efficiency.
4. Become familiar with WatchGuard security products.

Within Six Months, You Will...

1. Develop bespoke applications to improve WatchGuard's prevention, detection, and response capabilities.
2. Improve security event analytic logic to increase coverage and reduce false positives.
3. Help develop and maintain best practices and security standards for managing risk at WatchGuard.
4. Apply your knowledge and understanding of WatchGuard products to provide security guidance outside of the SOC.
5. Continue to improve your own skillset in areas of information security, malware analysis, and/or ethical hacking.
6. Regularly contribute to thought leadership content, growing your brand as a security expert both within and outside of WatchGuard.