Senior Threat Detection Engineer

The Team:

Our Global information security organization is responsible for Security and Trust. We think security-offensively and defensively. We continuously monitor our global security posture and are always adapting to the ever changing threat landscape.

The Role:

At every Celonis office, we get things done quickly by cultivating an open-minded culture with creative, collaborative, autonomous teams in which the best ideas win. As a Senior Threat Detection Engineer, you will be a trusted engineer in the Celonis Information Security organization and work with teams within Celonis’ Security program to maximize the Threat Detection capability and the SIEM/log data value and effectiveness.

The work you’ll do:

• Support, maintain, and expand Threat Detection infrastructure in a highly resilient configuration and recommend improvements to existing environments
• Building and maintaining production-quality dashboards to provide visibility into the security posture in a multi-tenant environment
• Develop advanced threat detection mechanisms using complex data analytics that can effectively identify and raise alerts for any adversarial or high risk behaviors
• Continuous improvement and fine-tuning of detection systems to effectively adapt to new and emerging cyber threats
• Monitor the agent and server infrastructure for capacity planning and optimization, with an eye on scalability and the rapid ingestion of new log sources

The qualifications you need:

• 5+ years in a dedicated Threat Detection or Security Engineering role.
• Hands-on experience with SIEM, EDR, and Databricks.
• Strong proficiency in log correlation techniques to identify patterns and anomalies indicative of malicious activity.
• Expertise in constructing complex queries using languages such as SPL, YARA, KQL, SQL, and other query languages to analyze large volumes of data; and enhance visibility and monitoring capabilities.
• Experience with “Detection as Code”; comfortable writing detection logic in a code repo (CI/CD).
• Strong analytical skills and the ability to effectively identify and resolve problems.
• Expertise in developing and refining detection methods using logs from network, endpoint, cloud, and SaaS. Strong understanding securing multi-tenant cloud environments.
• In-depth knowledge of fundamental security principles, common attack TTPs used throughout the Cyber Kill Chain, and frameworks like MITRE ATT&CK.
• Ability to handle and analyze large and complex datasets, identifying meaningful security insights and trends. Understanding data processing pipelines, performance considerations when querying large datasets, and synthesizing findings into actionable intelligence.
• Solid grasp of Data Engineering basics: ETL processes, SQL for data manipulation, and Spark for large-scale, distributed data processing.