Detection Engineer

About Opportunity: Global Cybersecurity (GCS) protects State Street and its clients from the impact of cyber-attacks against systems by understanding the risks these attacks present and mitigating them through a robust, continuously evolving, cybersecurity program and control environment. Fusion & Security Operations (F&SO) is one of five functions that make up GCS. F&SO works to provide real-time knowledge of cyber threats of today collectively to better prepare State Street for threats of tomorrow. This Cloud Detection Engineer I will sit in the Fusion Architecture & Detection Engineering sub-function in F&SO. This role is responsible for detecting possible cybersecurity attacks and compromises and sending cogent alerts for analysis by the security operations center. Other responsibility areas are listed below. Responsibilities: Draft and deliver detection use cases in the Splunk Processing Language (SPL); Kusto Query Language (KQL); Falcon Query Language (FQL) and other security query languages. Draft and deliver Jira and Confluence pages about cloud detection use cases following prescribed business processes. Investigate threat reports and request for detections to determine if a new detection use case is warranted. Present production ready use cases to executive governing boards for review and approval. Write detection oriented business cases, project plans, and reasoned explanations for decisions made about detections to support the execution of detection engineering projects. Partners with technical and non-technical professionals to enhance detection functions, and to drive better protection and response. Preferred Qualifications: Highly diverse and relevant education and experiences, such as: ethical hacking, data analytics, law, military cyber operations, penetration testing, cyber defense, and cyber transformation program management. Broad knowledge of cyber security software, business processes, organizational structure, and challenges. Software development and scripting experience using RegEx, PERL, Python, or Powershell. Ability to create polished presentations in PowerPoint, PowerBI, or other data visualization tools. Experience at a large, multi-national financial services firm. Experience at a large, multi-national technology consulting firm. Required Qualifications: One year of experience in cybersecurity detection engineering gained through a Bachelor's (BSc) in STEM; or through employment or volunteering. Amazon Web Service (AWS) Solutions Architecture Associate, or Oracle Cloud Infrastructure (OCI) Architecture Associate, Certification. Knowledge of Oracle Cloud Infrastructure (OCI). Ability to code detection use cases using SPL, KQL, or FQL. Ability to use Splunk for detection engineering. Ability to perform data manipulation, analysis, and reporting using Python, r, or similar analytics language. Ability to use Structured Query Language (SQL). Knowledge of the cyber global threat landscape; cyber adversaries; cyber tactics, techniques, and procedures (TTPs); cyber threat intelligence sources and methods; and malware. Knowledge of infrastructure and application telemetry. Ability to use Jira and Confluence to develop, document, collaborate, and release use cases into production environments. Ability to write polished descriptive and persuasive business documents. Ability to craft reasoned explanations for decisions that can withstand audit scrutiny. #cyberireland State Street's Speak Up Line To be considered for this role you will be redirected to and must complete the application process on our careers page. To start the process click the Continue to Application or Login/Register to apply button below.