Senior Security Engineer - Threat Detection

Job Posting Title:

Senior Security Engineer - Threat Detection

Req ID:

10118053

Job Description:

At Disney, we’re storytellers. We make the impossible, possible. The Walt Disney Company (TWDC) is a world-class entertainment and technological leader. Walt’s passion was to continuously envision new ways to move audiences around the world—a passion that remains our touchstone in an enterprise that stretches from theme parks, resorts and a cruise line to sports, news, movies and a variety of other businesses. Uniting each endeavor is a commitment to creating and delivering unforgettable experiences — and we’re constantly looking for new ways to enhance these exciting experiences.

The Enterprise Technology mission is to deliver technology solutions that align to business strategies while enabling enterprise efficiency and promoting cross-company collaborative innovation. Our group drives competitive advantage by enhancing our consumer experiences, enabling business growth, and advancing operational excellence.

The Global Information Security (GIS) organization strives to secure the magic by employing best-in-class services to assess, prevent, detect, and respond to cyber threats that present risk to The Walt Disney Company. We enable the business by integrating enterprise and business segment-specific supported services to create a robust, efficient, and adaptable cybersecurity program. Our key objectives are to:

• Secure the Magic by protecting information systems and platforms.
• Reduce Risk by proactively assessing, preventing, and detecting to prevent harm to the Company and our Guests.
• Strengthen the business through optimizing execution, application, and technology used to protect the Company.
• Innovate by investing in core capabilities to enhance operational efficiency.

Team Description:

We are seeking a skilled and experienced Senior Security Engineer with a specialization in Detection Engineering to join our GIS Anomaly Detection Team. In this role, you will be responsible for designing, developing, and maintaining detection mechanisms to identify anomalous and malicious activities within our environment. Your expertise in Splunk and detection content development will be instrumental in improving visibility and detecting threats before they can impact our systems and data. You will collaborate closely with security teams, stakeholders, and engineers to enhance our overall security posture through innovative detection strategies and continuous improvement.

Key Responsibilities:

• Detection Engineering: Lead and execute the development of advanced detection logic to identify potential security threats, vulnerabilities, and malicious activities within the enterprise environment. 
• Content Development: Design and implement detection rules, alerts, and dashboards in Splunk to enhance threat visibility and response capabilities. Optimize detection logic to minimize false positives and ensure actionable alerts. 
• Detection Use Case Development: Collaborate with stakeholders to build and refine detection use cases aligned with the threat landscape and organizational priorities. Leverage frameworks such as MITRE ATT&CK to create robust, behavior-based detections. 
• Threat Intelligence Integration: Partner with the Cyber Threat Intelligence (CTI) team to incorporate threat intelligence feeds, indicators, and TTPs into detection rules. Ensure detection content is adaptive to emerging threats. 
• Testing and Tuning: Perform continuous testing and tuning of detection content to ensure effectiveness, reliability, and performance. Collaborate with red team and threat hunting teams to validate detection coverage. 
• Automation: Partner with the SOAR team to develop and implement automated workflows and integrations that enhance the efficiency and scalability of detection processes. Collaborate to ensure seamless integration of detection logic with automation capabilities for improved threat response. 
• Collaboration: Work closely with security operations, threat hunting, and engineering teams to ensure seamless integration of detection capabilities. Share insights and contribute to a unified approach to threat detection and response. 
• Continuous Improvement: Stay current with emerging cybersecurity trends, detection methodologies, and tools. Proactively propose and implement improvements to detection capabilities and workflows. 
• Documentation and Reporting: Maintain thorough documentation of detection content, processes, and improvements. Support the Threat Detection Staff Lead in generating detailed reports and metrics for stakeholders to showcase detection program effectiveness.

Must Haves: