Paranoids Senior Detection Engineer

It takes powerful technology to connect our brands and partners with an audience of hundreds of millions of people. Whether you’re looking to write mobile app code, engineer the servers behind our massive ad tech stacks, or develop algorithms to help us process trillions of data points a day, what you do here will have a huge impact on our business—and the world.

A Little About Us

When you impact millions of people every day, you become a large target for adversaries of all types within all layers of the stack. Our job is to keep our users safe and make Yahoo one of the safest places on the Internet.

We are the information security team at Yahoo; known as "The Paranoids".

As a part of the Paranoids Detection Engineering Team, we protect Yahoo, its brands, and their users. We ensure that our users are kept safe from targeted attacks and account hijacking by government backed attackers. We investigate cyber threats which affect Yahoo's infrastructure, properties, and worldwide user base and apply innovative legal and technical remedies to mitigate those activities.

A Lot About You

We are seeking an awesome Senior Detection Engineer to join our security team. Our ideal candidate will develop creative detections in order to identify a wide range of cybersecurity threats, from criminal groups to APTs and even insider threats. Our candidate will build and maintain threat detection rules using Python, YAML, Databricks, and SQL, but most importantly will work hand in hand with our Incident Response Team and Insider Threat Program to find adversaries. Our candidate will also work with our Advanced Cyber Threat Team to integrate threat intelligence to enhance our detection capabilities. 

You are an ideal candidate for our team if you value:

• Protecting employees and users, and making the Internet a safer place for everyone.

• Demonstrating a high level of curiosity and staying ahead of the latest cyber threat landscape and threat intelligence trends.

• Taking a proactive nature to identify gaps and resolve problems.

• Finding and stopping bad actors. 

• Working with a large cybersecurity team to brainstorm challenging problems. 

On a typical day, you may find yourself:

Utilizing internal Yahoo tools, cyber-threat intelligence feeds, and commercial solutions to build creative solutions for identifying adversaries in our environment.

• Develop and implement threat detection rules using Python and YAML.

• Supporting data processing and analysis using Databricks to aid threat detection.

• Writing and optimizing SQL queries to extract and analyze security-related data.

• Helping to integrate threat intelligence feeds and data sources to improve detection accuracy.

• Working with our  Incident Response Team and Insider Threat Program to develop real-time detections during security investigations. 

• Participating in regular reviews and updates of detection rules to adapt to evolving threats.

• Authoring documentation and reporting on detection rule performance and effectiveness.

• Engaging in threat hunting activities to proactively identify potential security threats.

• Having fun with your team! 

Requirements include a bachelor's degree or equivalent experience, development in Python and familiarity with writing performant SQL queries, working with SIEM systems, familiarity with statistical analysis and machine learning models.

An ideal candidate will also have a strong understanding of cyber threat detection frameworks such as MITRE ATT&CK or the Lockheed Martin Cyber Kill Chain® and the application of threat intelligence in building threat detection rules. Previous experience with tools we use (Databricks, Swimlane, etc.) could be helpful, but are not required.

The material job duties and responsibilities of this role include those listed above as well as adhering to Yahoo policies; exercising sound judgment; working effectively, safely and inclusively with others; exhibiting trustworthiness and meeting expectations; and safeguarding business operations and