No applications. Teams find and message you directly.
Join Selectel as a Detection Engineer to enhance monitoring coverage and develop detection rules for complex attacks.
Join Selectel as a Detection Engineer to enhance monitoring coverage and develop detection rules for complex attacks.
Responsibilities
- Expand monitoring coverage: Connect and integrate new event sources (security logs) from critical infrastructure nodes to ensure complete threat visibility.
- Normalize and enrich data: Structure raw logs to improve data quality and detection accuracy.
- Develop detection rules: Create and configure event correlation rules to identify complex multi-stage attacks, analyze false positives, reduce noise, audit and update existing content, manage exceptions.
- Monitor and respond with SIEM: Analyze alerts, qualify incidents, and conduct initial response to attacks to minimize damage, formulate Threat Hunting hypotheses, participate in investigations.
- Collaborate with risk analysis, vulnerability mitigation, and incident investigation teams.
- Document and maintain content: Threat detection rules, connected sources, parsers, etc.
Requirements
- Experience in information security (preferably in SOC).
- Understanding of SIEM system principles.
- Experience in writing and debugging detection rules.
- Knowledge of MITRE ATT&CK Framework and ability to apply it in practice.
- Experience with logs from various systems: OS (Windows, Linux), networks (Firewall, Proxy, DNS), NIDS, EDR, applications.
- Skills in parsing and normalizing logs.
- A plus: experience in automating routine tasks (Python, Bash).
- A plus: experience applying ML/AI methods for log analysis or anomaly classification.