Lead Threat Detection Engineer

McKesson

📍 Irving, Texas, United States

Full-time Computer Occupations

Job Description

Position Description

/Responsibilities
  • Mature from a manual detection practice to a modern, automated, and standardized Detection-as-Code practice and infrastructure.
  • Develop use-cases based on intelligence, red team results, and incident data
  • Develop IOC workflows and a feedback loop for the Threat Intel Platform (TIP)
  • Write detection and correlation rules to identify threats across our stack
  • Assist in onboarding logs and identifying gaps in logs or alert results
  • Develop a deep understanding of data models, macros, indexes, sources, and field alias and the technology foundation our detection stack is built
  • Understand data schema/API standards, automation, and messaging systems
  • Bring a metrics-driven mindset to our rules, signals (IOCs), and alerts
  • Critical Requirements

  • Prioritize detection use-case and scope and create a logical rule
  • Ability to prioritize decisions to either write a rule and...
  • Apply for this Position