The Lead Security Engineer/Manager is responsible for the global management and operations of WAF/DDoS tooling across the enterprise. This role will be focused on customer threat detection work and needs to be an expert in WAF and detection as it relates to application security. The Lead Security Engineer/Manager develops new customer security detection use cases to detect and prevent fraud and abuse within Cox Automotive products.
PLEASE NOTE: this is an individual contributor opportunity
WHAT YOU'LL DO
Security Detection Engineering
- Manages and provides expert level guidance on configuring WAF (Web Application firewall) and Bot Management technologies across a large enterprise environment.
- Collaborates closely with engineering teams across the organization to provide operational support for WAF, Bot Management, and DDoS protection.
- Leads attack simulation tests to validate detection use cases are identifying attack patterns within on-prem and cloud systems.
- Develops customer threat detection and automated threat remediation use cases utilizing SIEM and other technologies.
- Develops and advances security tooling in-house to detect and respond to custom use cases.
- Collaborates with IR/Threat Intelligence and Threat detection team to continuously improve cybersecurity capabilities in identification, management, and response to threats in the most efficient and effective manner.
- Manages, administrates, and improves security monitoring products for WAF, SIEM, DDoS protection, and other industry standard security technologies.
- Leverages Threat Intelligence and performs threat hunting activities to identify compromised accounts and systems with EDR and other technologies.
- Proposes and helps review security plans and policies to improve the organization’s security posture.
- Maintains operational playbooks, diagrams, and documentation for security detection and response.
- Reviews proposed security deployments to ensure security monitoring requirements are met.
- Other duties may be assigned as needed to address new security threats facing the enterprise.
- Utilizes MITRE ATTACK and industry standard frameworks to build and test detection use cases.
- Provides off hour support as needed for security administration, detection, and response activities.
Incident Response
- Partners with Incident Response team to handle customer security and fraud related investigations.
- Perform incident response and forensic activities for internal and external threats.
- Reviews compromised systems to identify root cause of security incidents and remediation actions that need to be taken. Leverages forensic toolsets to investigate incidents and implements advanced forensic tools to speed up incident response investigations.
- Researches new TTPs (tactics, techniques, and procedures) that threat actors are utilizing to undermine enterprise IT environments.
- Provides timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, misuse, and distinguishes incidents and events from benign activities.
- Correlate incident data to identify specific vulnerabilities and make recommendations that enable swift remediation.
- Plans, implements, and documents incident handling, response tasks, and procedures.
Skills
Cyber Defense
Ability to:
- Work with internal IT teams and external MSSPs for security monitoring of WAF, DDoS Protection, Email systems, DLP, AV, and Endpoint security technologies.
- Perform data analytics, security event correlation, triage, and analysis.
- Apply security Threat Intelligence to respond appropriately to security events.
- Work on projects to improve security monitoring and response capabilities.
- Demonstrate a strong understanding of Zero Trust security best practices.
- Demonstrate a strong security engineering and architecture background to best understand how to employ the most effective and efficient security monitoring.
- Demonstrate effective communication of security issues to management and others.
- Maintain the security monitoring operational guidelines and standards for security.
WHO YOU ARE
Knowledge, Experience & Qualifications
- Bachelor’s degree in Computer Science or related field or equivalent combination of industry related professional experience and education.
- 6+ years related Security Engineering experience required
- Expert level knowledge on WAF, Web Security, DDoS protection, data analytics, and Bot Management
- Experience with developing SIEM/SOAR detection and automation use cases.
- Cloud security experience in AWS, Azure, or GCP
- GSEC, GCIA, GFE, GCFA, CISA, CISSP, CISM, or CIA certification(s)
- Working experience with Information Security, Application Security, and Security Monitoring and Incident Response.
- Must live within a commutable distance to either our Atlanta or NY office
About Cox
Cox empowers employees to build a better future and has been doing so for over 120 years. With exciting investments and innovations across transportation, communications, cleantech and healthcare, our family of businesses – which includes Cox Automotive and Cox Communications – is forging a better future for us all. Ready to make your mark? Join us today!
------------
Benefits of working at Cox may include health care insurance (medical, dental, vision), retirement planning (401(k)), and paid days off (sick leave, parental leave, flexible vacation/wellness days, and/or PTO). For more details on what benefits you may be offered, visit our benefits page.
Cox is an Equal Employment Opportunity employer - All qualified applicants/employees will receive consideration for employment without regard to that individual’s age, race, color, religion or creed, national origin or ancestry, sex (including pregnancy), sexual orientation, gender, gender identity, physical or mental disability, veteran status, genetic information, ethnicity, citizenship, or any other characteristic protected by law.