Threat Researcher – Detection Engineer - Windows OS
United Kingdom
Threat Intelligence – Threat Research and Engineering (SophosLabs) /
Permanent /
Remote
Role Summary
Threat hunter? Programmer? Data-driven?
We have a fantastic opportunity here at Sophos Labs for a Threat Researcher to join our global team of behaviour-based detection engineers, to hunt, to research, and to add real-time detection for suspicious activity across our customer environments.
Our team of skilled security experts combine their passion to detect & disrupt cyber-attacks with their capability to develop classification rules that can cut through the noise in modern computing environments to tease out attacker’s nefarious activities.
You are intrinsically motivated to understand the core logic behind malware and hacking attacks, to find & predict new ways attackers will modify their techniques, and take great satisfaction in developing robust detection logic that is immune to evasive actions. You will be responsible for writing rules that are able to detect malicious activities across all types of TTP (even if a Mitre Technique doesn’t exist yet). This is the foundation of Sophos next-gen approach.
Above all - you enjoy thinking creatively; combining your deep technical knowledge, your tenacity for innovation, and your can-do attitude to solve complex and challenging problems on a daily basis.
What You Will Do:
- Understand malware kill chain and lifecycle & hands-on-keyboard attacks
- Mapping TTPs to MITRE ATT&CK matrix
- Accurate & efficient classification of malicious & suspicious behaviour
- Author classification rules, for both Endpoint & Cloud scenarios, to identify malicious & suspicious use of TTPs
- Analyse real world kill chains to discover new TTPs and gaps in coverage
- Measure and tune TTP coverage through data mining, customer telemetry & internal sandbox feeds
- Build & maintain playbooks on threat actor TTPs
What You Will Bring:
- Strong knowledge of Windows operating system, internals & forensic tools
- Demonstrated programming experience. Preferred: Python, Lua, RegEx and/or SQL.
- Excellent grasp of MITRE ATT&CK tactics, techniques & procedures in order to create simulation
- Familiar with computational cost analysis & problem solving to minimize impact
- Bachelor degree in Computer Software (Computer Security preferable)
- Big data experience, Elastic Search, Kibana, Redshift
- SDLC or CI/CD Knowledge is a plus
- Bachelor’s degree in computer software (Computer Security preferable) or equivalent experience
#B2
