Want to know if this job is worth applying to?
Pittsburgh, Pennsylvania, United States
Onsite
What We Do:
Our team, within the Cyber Risk and Resilience Directorate researches, designs, and develops software tools for the collection, storage, and analysis of network data to provide security insights. We provide both the core network tools to facilitate this capability, and prototypes of new methods to present the data most effectively. We work with data at a scale generally not experienced by most organizations, handling record counts in the tens of billions per day.
Developing security insights at this scale requires creativity, efficiency, and contemporary knowledge of modern computing platforms. In some cases, the computing has outpaced the methods, and it is incumbent upon us to generate novel views of both the entire data collection, and of focused datasets tailored to specific analyst needs.
Our network situational awareness security tools are published here: https://tools.netsa.cert.org/
Position Summary:
As a senior network security researcher on the Network Situational Awareness team, you will research network threats to develop methods of detection and tailor these for partner environments. Transition of this research will take the form of developing detection capabilities, providing new requirements and feature requests for our NetSA Security tool suite, writing publications, and providing customer-specific training. The primary network data source for the team is netflow combined with application layer metadata, with an expanding focus on host-based (e.g., EDR) and cloud telemetry.
You will be responsible for gaining insights from data to facilitate detections, working with partners to help them to better understand their data and researching new data sources to expand the expertise of the team.
Requirements: (education/travel/background ONLY)
Knowledge, Skills and Abilities:
Proven ability to discern and translate threat intelligence to avenues for research, prototyping, and curation of detection capabilities.
Expert knowledge of network fundamentals, common application layer protocols, and network-based telemetry.
Strong proficiency in at least one scripting or programming language such as Python, Go, Ruby, C, Java, or Scala.
Expert problem-solving skills and analytical skills, detailed research, and ability to document and communicate ideas and findings to diverse audiences.
Desired Experience:
Hands-on experience in a security research, threat hunting, detection engineering, or Cyber threat Intelligence (CTI) analyst role.
Significant experience large datasets, especially network telemetry such as netflow, application metadata, or PCAP from network sensors such as YAF, Zeek, Suricata, etc;
Experience applying cybersecurity data science methods and practices
Experience using open-source and / or commercial Internet intelligence telemetry and datasets
Thorough and up-to-date awareness of the threat landscape and experience researching and investigating threats
Significant experience presenting technical topics to a wide array of audiences
Location
Arlington, VA, Pittsburgh, PAJob Function
Software/Applications Development/EngineeringPosition Type
Staff – RegularFull time/Part time
Full timePay Basis
SalaryPlease visit “Why Carnegie Mellon” to learn more about becoming part of an institution inspiring innovations that change the world.
Click here to view a listing of employee benefits
Carnegie Mellon University is an Equal Opportunity Employer/Disability/Veteran.