Cybersecurity Threat Detection Engineer

The Bank sponsors individuals for TN and H-1B transfers on a case by case basis. Please note that this position is not open to anyone on an F-1 student visa including those eligible for CPT/OPT or the Stem OPT extension.

At M&T Tech, we’re a team of makers, doers, and builders, working to create the most advanced technology solutions in banking.  We’re not your stereotypical suit and tie bankers: we’re an innovative team of leading tech experts, pushing boundaries, and taking risks.  We’re building an agile team of the most skilled and creative workers to solve complex problems, architect solutions, write high-performance software, and chart our new path, all to make the lives of our customers, and the communities that we serve, better.  Join us and be part of something new as we build tomorrow’s bank, today.

Overview:

Design, deliver and maintain robust threat detection capabilities using advanced threat analytic systems to safeguard the organization's information and information systems. May complete daily support activities and special projects.  Often directs and monitors the activities of less experienced staff.  Coordinates with Cybersecurity teams, stakeholders and leadership to provide framework, design, threat, posture analysis and reporting.  

Primary Responsibilities:

• Design, develop and maintain threat detection rules, alerts and use cases to support the organization's detection strategy
• Leverage Risk Based Analytics to prioritize and manage security events based on risk scores to enhance effectiveness and accuracy of threat detection and response.
• Continuously evaluate and improve the performance and efficacy of the SIEM by tuning existing rules and integrating new data sources.
• Leveraging expert knowledge of the dynamic threat landscape, leverage advanced capabilities to detect advanced multi-stage attack scenarios. 
• Provide backup to higher management, and may act on behalf or as a surrogate leader as required.
• Understand and adhere to the Company’s risk and regulatory standards, policies and controls in accordance with the Company’s Risk Appetite.  Identify risk-related issues needing escalation to management.
• Promote an environment that supports diversity and reflects the M&T Bank brand.
• Maintain M&T internal control standards, including timely implementation of internal and external audit points together with any issues raised by external regulators as applicable.
• Complete other related duties as assigned.

Education and Experience Required:

Associates’ degree in an applicable discipline and a minimum of 6 years’ relevant work experience in two (2) or more of the following Cybersecurity domains:  Security and Risk Management, Asset Security, Security Engineering, Communication and Network Security, Identity and Access Management, Security Testing and Security Operations, or in lieu of a degree, a combined minimum of 8 years’ higher education and/or work experience, including a minimum of 6 years’ relevant experience in two (2) or more of the following Cybersecurity domains:  Security and Risk Management, Asset Security, Security Engineering, Communication and Network Security, Identity and Access Management, Security Testing and Security Operations

Understanding of the System Development Life Cycle (SDLC), networking concepts and protocols, and network security methodologies

Experience researching and recommending application development support software and hardware platforms through an understanding of client area function and deliverable requirements for current and future-state planning

Detailed technical experience with mainframe, distributed computing environments and network security architecture concepts including topology, protocols, components and principles

Prior experience and demonstrated aptitude for quickly learning multiple new technical skills and supporting multiple systems, tools and processes

Experience actively leading complex problem and technical analysis walkthroughs

Detailed technical experience with Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), attack methodologies and traffic flows for threats and vulnerabilities

Detailed technical knowledge of cybersecurity and privacy principles and organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation)

Experience acting as a surrogate team leader to assign, review, evaluate and prioritize team efforts

Education and Experience Preferred:

Bachelor’s degree in an applicable discipline

Experience introducing application development alternatives through an understanding of client area function and deliverable requirements for current and future-state planning

Extensive technical experience with SIEM technologies