Detection Engineer

ADP, Inc.; Madrid; Híbrido; EUR 60.000 - 90.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid work schedule

Descripción de la vacante

ADP is seeking a Threat Detection Engineer to join a Global Security team. You will design, build and maintain cyber alert catalogs, develop detections, and collaborate with CIRC, threat management, and engineering teams to protect ADP assets.

You will drive SOAR development, code in Python and SQL, and help mature playbooks and automation in a hybrid work environment.

Formación

• 2 years+ experience in threat detection or threat hunting.
• Analytical and cross-functional skills across security disciplines.
• Strong communication skills, both written and verbal.
• Experience with databases and data warehouse technologies.
• Experience with system automation in Python or PowerShell.
• Experience building detection logic using security logs with high fidelity.
• Project/program management experience.
• Experience with one or more cloud providers (AWS or Azure).
• Familiar with log outputs from multiple device classes and protocols.

Responsabilidades

• Develop advanced alerting capabilities from threat intel and incidents.
• Maintain expert understanding of attacks, vectors and threats.
• Create detections for SOAR platform per stakeholder requests.
• Collaborate with CIRC and threat management to define requirements.
• Develop content for EDR, NDR, and SOAR implementations.
• Stay updated on threats and integrate knowledge into detections.
• Contribute to SOP development and updates.
• Provide deliverables including reports, SOPs, and training materials.
• Build tailored security detections with engineering teams.

Conocimientos

Threat detection

Threat hunting

Analytical skills

Cross-functional knowledge

Verbal presentation

Written communication

Databases & data warehouse

Scripting: Python

Scripting: PowerShell

Cloud platforms (AWS/Azure)

SIEM & SOAR

Security logs analysis

Networking knowledge (DNS/HTTP/etc)

Herramientas

Python

PowerShell

SOAR

EDR/NDR

Cloud providers (AWS/Azure)

SQL/REST/XML/JSON

Descripción del empleo

ADP is hiring a Threat Detection Engineer

In this role, you will work with Global Security teams from Critical Incident Response Center (CIRC), Threat Intelligence, Threat Hunting, Red Team, and AppDev, to create and drive threat detection to protect ADP assets.

You will help lead efforts to design/define/create requirements to develop prevention, detection, and response capabilities within ADP Cyber security platforms.

You will collaborate with other Detection Engineers to design, build & maintain cyber alert catalogs.

You are keen on promoting the use of innovative new technology and best practices for evolving security objectives.

You can present your ideas clearly, professionally on paper, in person, on video calls, and over the phone.

You have solid experience analyzing and defining solutions, maintaining and enhancing existing solutions, and participating in the delivery of projects.

You enjoy brainstorming new concepts and collaborating with your team members.

You can work with partners in IT, Ops, and Engineering to provide support for troubleshooting Production issues.

Our best engineers are enthusiastic creators who stay current on new ways of optimizing threat detections and processes and enhancing business intelligence automation. They are always looking for new ways to improve detection quality.

To thrive as a threat detection engineer, you'll need to enjoy SOAR Development and coding in Python and SQL.

You'll need an understanding of leveraging APIs to pull and push data from different data sources to update records in the SOAR platform.

WHAT YOU'LL DO:

Here’s what you can expect on a typical day in the life of a Threat Detection Engineer at ADP.

• Develop advanced alerting capabilities based on threat intelligence, post-incident findings, new threats, and vulnerabilities.
• Maintain an expert-level understanding of attacks, vectors, and emergent threats.
• Develop new detection for our SOAR platform based on specific requests from stakeholders, threat intelligence, threat hunting, or purple exercise.
• Collaborate regularly with our CIRC and threat management to understand their requirements and needs.
• Experience with creating and implementing content in EDR, NDR, and SOAR.
• Stay updated with the latest threats and familiar with APT and common TTPs to integrate knowledge into new detections.
• Contribute to the development and updating of SOPs.
• Ability to provide content on deliverables, including written reports and technical documents, SOPs and configuration guides, and training and briefing materials.
• Work closely with the CIRC, Threat management team, and engineering teams to improve and build new tailored security detections.
• Analyze CIRC alert statistics and workflows to reduce false positives and properly focus engineering efforts.
• Provide design support on ways to improve detection and response capabilities.
• Provide backup support to the CIRC team when necessary.
• Help mature CIRC playbooks, workflow automation, and use cases to protect ADP assets.
• Build detection logic utilizing security logs to detect malicious activity with high fidelity across a broad set of detection cyber use cases.
• Act as a subject matter expert in multiple areas: security log signals from Linux, macOS, Windows, EDR, NDR, and cloud.

Qualifications:

• 2 years+ experience in threat detection or threat hunting
• Strong analytical skills and cross-functional knowledge across multiple security disciplines.
• Strong interpersonal, verbal presentation, and written communication skills.
• Strong knowledge and working experience with databases and data warehouse technologies and solutions.
• Strong working experience with systems automation in a major scripting language (Python, PowerShell).
• Strong experience building detection logic utilizing security logs to detect malicious activity with high fidelity across a broad set of detection use cases.
• Strong project/program management experience.
• Working experience with one or more cloud providers, such as Amazon Web Servicesor Microsoft Azure.
• Familiar with interpreting the log output of a wide selection of network and host device classes(HIDS, NIDS, Firewalls, Proxies, Routers, Switches, WAFs, Servers, Desktop Controls, Endpoint Protection, etc.).
• Functional experience with text and data representation and manipulation (XML, HTML, Regular Expressions, JSON, REST, SQL).
• Packet-level behavioral familiarity with most major TCP/IP application protocols ( DNS, SMTP, HTTP, BGP, LDAP, IMAP, SSH, FTP, KRB5, DHCP, CIFS).
• Experience working with SIEMand SOAR
• Creative thinker that leverages unconventional and innovative ideas to solve problems.
• Ability to communicate security-related concepts to a broad range of technical and non-technical staff.
• Must possess a high degree of integrity, be trustworthy, and have the ability to work independently.

#LI-FD1

#LI-Hybrid

A little about ADP: We are a comprehensive global provider of cloud-based human capital management (HCM) solutions that unite HR, payroll, talent, time, tax and benefits administration and a leader in business outsourcing services, analytics, and compliance expertise. We believe our people make all the difference in cultivating a down-to-earth culture that embraces our core values, welcomes ideas, encourages innovation, and values belonging. We've received recognition for our work by many esteemed organizations, learn more at ADP Awards and Recognition.

Diversity, Equity, Inclusion & Equal Employment Opportunity at ADP: ADP is committed to an inclusive, diverse and equitable workplace, and is further committed to providing equal employment opportunities regardless of any protected characteristic including: race, color, genetic information, creed, national origin, religion, sex, affectional or sexual orientation, gender identity or expression, lawful alien status, ancestry, age, marital status, protected veteran status or disability. Hiring decisions are based upon ADP’s operating needs, and applicant merit including, but not limited to, qualifications, experience, ability, availability, cooperation, and job performance.

Ethics at ADP: ADP has a long, proud history of conducting business with the highest ethical standards and full compliance with all applicable laws. We also expect our people to uphold our values with the highest level of integrity and behave in a manner that fosters an honest and respectful workplace. Click https://jobs.adp.com/life-at-adp/ to learn more about ADP’s culture and our full set of values.