Detection Engineer

Vectra® is the leader in AI-driven threat detection and response for hybrid and multi-cloud enterprises.

The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in a single platform. Powered by patented Attack Signal Intelligence, it empowers security teams to rapidly prioritize, investigate and respond to the most advanced cyber-attacks. With 35 patents in AI-driven threat detection and the most vendor references in MITRE D3FEND, organizations worldwide rely on the Vectra AI to move at the speed and scale of hybrid attackers. For more information, visit www.vectra.ai. 

Position Overview 

We are seeking an experienced Threat Detection Engineer to extend Vectra's detection capabilities across cloud and identity environments, with additional exposure to network-based threat detection. 

Vectra's Attack Signal Production Group is responsible for building Vectra's core threat detection and prioritization technology, leveraging AI and other methods to alert customers to critical threats across their cloud, identity, and network environments. 

Threat Detection Engineers work closely with Data Scientists who are developing AI models, and Security Researchers who are researching the threat landscape and assisting modeling efforts. This role will focus primarily on developing detections for cloud and identity attack behaviours, including threats across AWS, Azure, GCP, and identity platforms such as Microsoft Entra ID. 

The ideal candidate has hands-on experience investigating cloud and identity threats using telemetry such as authentication and audit logs, CloudTrail, cloud platform logs, and network flow data. Familiarity with network threat models, protocols, and network-based telemetry is important, particularly as cloud detection increasingly incorporates data sources such as VPC and flow logs. 

The role is primarily focused on cloud and identity threat detection, while providing the versatility to contribute to network detection initiatives where relevant. 

Responsibilities and Accountabilities 

• Research cloud and identity attack behaviours and identify opportunities for new detections. 

• Develop, test, and maintain detection logic using Python and other appropriate detection technologies. 

• Analyze telemetry from cloud and identity environments, including authentication activity, control-plane activity, audit logs, application logs, and network flow logs. 

• Develop detections across common cloud platforms such as AWS, Azure as well as identity environments such as Microsoft Entra ID.