LHH Recruitment Solutions seeking a highly skilled Senior Staff Engineer to join our rapidly growing cybersecurity team. In this role, you will focus on threat detection, incident response, and continuous monitoring to protect our organization's critical assets. You will work closely with product owners and business units outside Information Security to ensure that all applications, systems, and processes are secured and hardened.

Role is located in Alameda County, completely on-site (no flexibility). This is a full time, direct hire, W2 position. **Employer is not able to support in visa transfer or sponsorship at this time or off C2C.**

Responsibilities:

• Oversee the end-to-end threat management process, from initial detection and analysis to containment, eradication, and recovery. Ensure that all incidents are thoroughly investigated and documented, and that lessons learned are incorporated into future threat management strategies.

• Lead and coordinate incident response efforts with different groups, ensuring timely and effective resolution of cybersecurity incidents.

• Develop and maintain incident response plans and playbooks to guide the team during cybersecurity events.

• Regularly assess the effectiveness of detection mechanisms and make necessary adjustments to improve accuracy and coverage. This includes conducting regular threat hunting exercises to identify gaps and areas for improvement.

• Create and refine correlation rules within the SIEM to identify complex attack patterns and reduce false positives. This involves analyzing cybersecurity events and developing rules that accurately detect malicious activities.

• Incorporate threat intelligence feeds into the team’s detection capabilities to stay updated on the latest threats and attack techniques. Use this intelligence to enhance detection rules and response strategies.

• Utilize machine learning and behavioral analytics to identify anomalies and potential threats that traditional signature-based tools might miss. This includes analyzing user behaviors and network traffic to detect suspicious activities.

• Regularly review and fine-tune the configurations of current cybersecurity tools such as SIEM, EDR, and IDS/IPS to ensure they are effectively detecting and alerting on potential threats.

• Conduct and analyze phishing simulations to assess and improve the organization's resilience against phishing attacks. Develop training and awareness programs based on the results to educate employees on recognizing and responding to phishing attempts.

• Work with various log sources and data feeds to enhance the visibility and detection capabilities of the team. This includes integrating logs from network devices, servers, applications, and cloud environments.

• Create and maintain playbooks to standardize and automate threat response procedures. This includes developing automated workflows to streamline incident response, reduce response times, and improve the overall efficiency and effectiveness of the cybersecurity operations team.

• Stay current with the latest threat landscape and emerging trends in cybersecurity to proactively identify and mitigate potential cybersecurity risks.

• Contribute to the overall information cybersecurity strategy.

Qualifications:

• Bachelor’s degree in a related discipline and 9+ years of related experience; or equivalent combination of education and experience.

• CISSP, CISM, CEH, OSCP, GIAC or similar cybersecurity certification required.

• Extensive experience in a SOC environment, with a strong background in threat detection, incident response, and threat hunting.

• Proven experience in implementing and managing a SOAR (Security Orchestration, Automation, and Response) platform.

• Experience with threat intelligence platforms and integrating threat intelligence feeds to cybersecurity tools to enrich threat detection.

• Experience in proactive threat hunting to identify and neutralize emerging threats.

• Experience with conducting and analyzing phishing simulations to enhance organizational cybersecurity awareness and resilience.

• Demonstrated experience and success in designing and implementing a comprehensive cybersecurity architecture that protects an organization's information assets and enables it to achieve its business objectives.

• Experience in leading, planning, executing, and managing projects.

• Experience or working knowledge of cloud, network, and application security.

• Experience in Biotech/Pharma is a plus.

Knowledge/Skills/Abilities:

• Proficiency with SOC tools and technologies such as SIEM (e.g., Splunk, QRadar), EDR (e.g., CrowdStrike, Cortex), and IDS/IPS (e.g., Snort, Suricata).

• Strong scripting skills (e.g., Python, PowerShell) to automate tasks, enhance detection capabilities, and develop automation through a SOAR platform.

• Ability to configure and fine-tune cybersecurity tools to maximize their effectiveness by integrating various log sources and data feeds to enhance visibility and detection.

• Ability to work with various data sources to create high-fidelity alerts.

• Knowledge of machine learning and behavioral analytics to identify anomalies and potential threats.

• Ability to develop and refine correlation rules within SIEM to detect complex attack patterns, leveraging the MITRE ATT&CK framework.

• Strong analytical skills to correlate events and make informed decisions based on data.

• Ability to analyze user behaviors and network traffic to detect suspicious activities.

• Ability to establish and maintain strong relationships with cybersecurity vendors.

• Good understanding of cybersecurity frameworks and standards such as NIST, ISO 27001, and PCI-DSS. Ability to interpret these standards and apply them to an organization's specific cybersecurity needs.

• Extensive knowledge of DNS, network protocols, firewalls, VPNs, web application firewalls, email security, IPS/IDS, SIEM, DLP, cryptography, application whitelisting, and endpoint protection.

• Excellent communication skills to effectively collaborate with cross-functional teams and present findings to senior management. Skilled in translating data-driven insights into clear narratives of risk and impact.

• Resourceful and proactive to find innovative solutions to challenges.

• A mindset focused on continuous learning and improvement.

• Ability to lead by example and mentor other cybersecurity team members.

• Ability to foster collaborative working relationships with technology groups and other stakeholders, including vendor relationships.

• Thorough planning and tracking skills, well-organized, focused on results, capable of managing multiple projects, excellent time management with respect to priorities and self-management.

• Outstanding judgment and problem-solving skills, including negotiation and conflict resolution.

• Ability to work in a team environment, create timelines, and continually make necessary adjustments.

Working Conditions:

• Environment: primarily working indoors in an office environment.

Salary Expectations and Benefits:

• 180,000 - 200,000

• Bonus

• RSUs

• 401k Match

• Competitive Standard Benefits

Equal Opportunity Employer/Veterans/Disabled

To read our Candidate Privacy Information Statement, which explains how we will use your information, please navigate to https://www.lhh.com/us/en/candidate-privacy

The Company will consider qualified applicants with arrest and conviction records in accordance with federal, state, and local laws and/or security clearance requirements, including, as applicable:

• The California Fair Chance Act
• Los Angeles City Fair Chance Ordinance
• Los Angeles County Fair Chance Ordinance for Employers
• San Francisco Fair Chance Ordinance