Sr Detection Engineer

Company Description

We create world-class content, which we distribute across our portfolio of film, television, and streaming, and bring to life through our theme parks and consumer experiences. We own and operate leading entertainment and news brands, including NBC, NBC News, MSNBC, CNBC, NBC Sports, Telemundo, NBC Local Stations, Bravo, USA Network, and Peacock, our premium ad-supported streaming service. We produce and distribute premier filmed entertainment and programming through Universal Filmed Entertainment Group and Universal Studio Group, and have world-renowned theme parks and attractions through Universal Destinations & Experiences. NBCUniversal is a subsidiary of Comcast Corporation.

Here you can be your authentic self. As a company uniquely positioned to educate, entertain and empower through our platforms, Comcast NBCUniversal stands for including everyone. Our Diversity, Equity and Inclusion initiatives, coupled with our Corporate Social Responsibility work, is informed by our employees, audiences, park guests and the communities in which we live. We strive to foster a diverse, equitable and inclusive culture where our employees feel supported, embraced and heard. Together, we’ll continue to create and deliver content that reflects the current and ever-changing face of the world.

Job Description

NBCUniversal’s Cyber Threat Operations team is responsible for providing threat intelligence, event monitoring, incident response, detection engineering and threat hunting for all business areas of NBCUniversal in a highly collaborative, fast paced, and agile fashion.

As a member of the Threat Detection Engineering Team, the Sr Detection Engineer will be expected to utilize his/her technical expertise to create detection logic to identify prioritized threats using logs and security telemetry.

The ideal candidate can dissect an adversary TTP and identify the logs and technologies required to identify that behavior in the NBCU environment. This candidate will focus on supporting, automating, and enhancing the threat detection engineering lifecycle to advance the in-house detection and response capabilities.  Additionally, this candidate will provide cross-business and project support as an SME advocate for the Cyber Threat Operations Team.

Qualifications

Basic Requirements:

• Bachelor’s Degree or equivalent work experience in an IT or Computer Engineering field.
• 6+ years of experience working in Cyber Defense with experience in Detection Engineering, Incident Response, Security Operations Center (SOC), Threat Intelligence, Threat Hunting, or similar functions.
• Experience crafting logic that detects threats in user, network, host, or cloud activity in a high-fidelity manner.
• Advanced knowledge of network, systems, cloud, containers, and web application attacks and mitigations.
• Experience in applying detection and response concepts to On-Premise and Cloud environments (AWS, Azure, GCP).
• Hands-on technical expertise in building scripts, tools, or methodologies that enhance threat detection and incident response capabilities. (Preferably SPL and Python).
• Ability to identify threats and adversaries by applying logic to logs and security telemetry.
• Knowledge of industry recognized security and analysis frameworks (MITRE ATT&CK, Kill Chain, NIST Incident Response, etc.).
• Strong communication and documentation skills with experience briefing executives and senior leadership.
• Understanding of offensive security principles.
• Must be self-motivated and able to work both independently and as part of a team.
• Willingness to provide support during nontraditional working hours in an on-call fashion.

Desired Characteristics:

• Ability to prioritize work based on risks and business needs
• Experience developing software automation solutions (Python)
• Experience in data engineering
• Experinece working with AttackIQ or similar Attack Simulation Technology
• UNIX systems experience and a solid grip on operating system fundamentals
• Previous experience providing incident response/offensive security/SOC support for Fortune 1000 companies
• Previous experience working with SIEMs and automation tools.
• Previous experience working with network tools and technologies such as firewall (FW), proxies, IPS/IDS devices, and email platforms
• Previous experience working with attack simulation technology
• Relevant certifications (OSCP, GCIA, GCIH, GCFA, GNFA, etc.)

Additional Requirements:

• Fully Remote: This position has been designated as fully remote, meaning that the position is expected to