About the job
Join us at the forefront of technology as we revolutionize the data storage landscape. At Pure Storage, you'll contribute to transformative projects, collaborate with some of the brightest minds in the industry, and embark on a journey of innovation and growth.
If you are passionate about making a difference and ready to embrace limitless opportunities, we invite you to be a part of our team.
ROLE OVERVIEW
As a Senior Security Engineer specializing in Detection Engineering, you will work closely with the security operations lead and the broader security team to establish and enhance security use cases across the organization. Your primary goal will be to design and refine detection policies and response strategies that empower our team to swiftly and accurately identify actual threats, misuse incidents, intrusions, and data loss events.
This is an active role that requires a deep understanding of our business operations, attacker methodologies, and where critical signals reside. Your expertise will translate into robust security content and effective response workflows. In this position, success is evaluated not on the number of alerts, but on the quality of signals, reduction of attacks, accelerated containment, and ongoing operational enhancements.
KEY RESPONSIBILITIES
- Design, implement, and manage high-fidelity detections, correlation rules, alerts, dashboards, and use cases within Splunk and related security tools.
- Create detection mechanisms across various data domains, including identity, endpoint, network, cloud infrastructure, SaaS applications, DLP, vulnerability management, and asset posture.
- Integrate signals from multiple tools and data sources to uncover attacker behavior, misuse, anomalous activities, and significant security risks.
- Collaborate with business units, IT, engineering, and security stakeholders to align business processes and workloads with necessary security use cases and telemetry.
- Engage in incident triage, investigation, containment, and post-incident improvement efforts.
- Develop enrichment and automation workflows utilizing Python, APIs, and security tools to enhance analyst efficiency and consistency in responses.
- Refine detection quality by calibrating noisy alerts, minimizing false positives, and increasing the true positive detection rate.
- Contribute to the logging strategy, event onboarding, normalization, parsing, correlation, retention, reporting, and platform customization.
- Leverage threat intelligence, attacker tradecraft, and frameworks such as MITRE ATT&CK, CVE/CVSS, and risk context to facilitate meaningful detections.
- Produce playbooks, runbooks, detection documentation, and operational guidelines for the security team.
