Head of Detection Engineering - Meraki

Cisco Systems, Inc.; San Francisco, California, Miami (CA, MO, FL); Remote; USD 90,000 - 160,000; Full time

Job summary

An innovative firm is seeking a Detection Engineering Lead to enhance its cybersecurity posture. This role involves overseeing the detection engineering program, mentoring a team, and collaborating with various security teams to improve threat detection capabilities. The successful candidate will have a strong background in detection engineering, experience with AI workflows, and the ability to analyze metrics for program success. Join a dynamic team committed to fostering a positive culture and making a significant impact on security for a global customer base. This position offers the chance to work in a fully remote environment, ensuring flexibility and work-life balance.

Qualifications

• Hands-on experience with detection engineering in a security operations context.
• Experience with metrics for a maturing Detection Engineering program.

Responsibilities

• Oversee the strategic planning and execution of the detection engineering program.
• Develop key performance metrics to track program effectiveness.

Skills

Detection Engineering

AI in Detection Engineering

Threat Hunting

Incident Response

Security Operations

SQL

Python

Communication Skills

Education

Relevant Industry Certifications

Formal Software Engineering or Data Science Experience

Tools

Splunk

SIEM Solutions

SOAR Solutions

AWS

Job description

At Cisco Meraki, we know that technology can connect us, empower us, and drive us. By simplifying powerful technology we can free hardworking people to focus on their mission. As the fastest-growing cloud-managed networking team in the world, our products and technology architecture are changing the face of enterprise networking and making cloud-managed IT a reality!

Our Meraki Security organization provides critical cybersecurity and business protection to Meraki and our customers globally. Our mission is to earn and maintain customer trust by protecting, defending, and improving the security of Meraki products, systems, and services. In order to support a global customer base, the Meraki Detection Engineering Team is a fully remote team with employees in multiple locations and time zones.

As a direct report of the Head of Threat Management, you will be responsible for leading Cisco Meraki’s Detection Engineering program. You will be responsible for helping build, maintain, and improve our threat detections and alerting infrastructure. You will also be responsible for ensuring Meraki Security has the right data collection and log visibility in place to discover threats against our infrastructure, data, employees, and customers. We are looking for engineers who are self-starters, curious, and are comfortable operating in environments where there are lots of unknowns. This position will require frequent collaboration with the other Threat Management capabilities, including Threat Response, Insider Threat, and Threat Intelligence.

The program you run will have a direct, immediate, and positive impact on our internal security, external customers, and the hundreds of millions of users that use and rely on Meraki access points, switches, security appliances, and cameras every single day. We are passionate about building real products that our customers love. We believe in fostering a positive culture by hiring, mentoring, and empowering thoughtful, conducive, humble people. With the support of management, we constantly look within for ways to improve organizationally. Finally, we maintain a positive relationship with Cisco that gives us the stability and resources of a larger company without sacrificing our startup vibe!

Key responsibilities:

1. Oversee the strategic planning, execution, and continuous improvement of the detection engineering program.
2. Develop and report on key performance metrics to track the effectiveness and maturity of the Detection Engineering program.
3. Lead and mentor a team of two contractors ensuring alignment with program goals.
4. Liaison with other Cisco Security teams and business units doing similar Detection and Response work.
5. Ideate, design, develop, test, monitor, and tune high-quality detections to ensure our security analysts can respond effectively to security threats.
6. Write complete and well-documented alerting and detection strategies to provide necessary context and runbooks for security analysts and incident responders.
7. Serve as a subject matter expert for security-relevant logs and data, assisting the Incident Response team during high-priority investigations.
8. Build, maintain, and improve custom detection and alerting solutions, ensuring commercial tools are optimized to meet detection coverage needs.
9. Collaborate with the Threat Intelligence team to build impactful detections that enhance Meraki’s security posture.
10. Work closely with the Insider Threat team to develop and implement strategies for detecting and mitigating insider threats.
11. Support other security program initiatives to improve the Threat Management team’s security visibility.
12. Independently propose logging modifications and improvements to other Engineering and Software Development teams to ensure the necessary detections can be built.

You are an ideal candidate if you have:

1. Proven hands-on experience with full-lifecycle detection engineering in support of a security operations team.
2. Knowledge and interest in the use of AI in detection engineering workflows.
3. Experience with defining, collecting, and analyzing various metrics that exhibit the purpose and success of a maturing Detection Engineering program (i.e. MITRE ATT&CK coverage).
4. Experience building and managing high-performing security programs and teams.
5. Experience as a Threat Hunter, Security Operations Analyst, or Incident Responder.
6. Comfortability operating in Splunk or other common SIEM and SOAR solutions.
7. Technical depth in one or more of the following specialties: offensive security, application security, cloud security, digital forensics, malware analysis, threat hunting, incident response or some combination thereof.
8. Familiarity with SQL, relational databases, and data warehousing.
9. Basic Python (or other scripting language) experience in order to automate tasks within our case management and CI/CD environment.
10. Demonstrated knowledge of threat actor techniques, vulnerabilities, and exploits, and how those present themselves within logs and various endpoint/network artifacts.
11. Excellent communication and collaboration skills, with the ability to work with a high degree of autonomy.
12. Relevant industry certifications.
13. Formal software engineering, DevOps, or data science experience from prior jobs, trainings, or academia.
14. Hands-on experience building tools and solutions within a public cloud environment, preferably AWS.
15. Experience with PCI-DSS, FedRAMP, and other compliance frameworks and their associated logging and detection requirements.