About Opportunity:

Global Cybersecurity (GCS) protects State Street and its clients from the impact of cyber-attacks against systems by understanding the risks these attacks present and mitigating them through a robust, continuously evolving, cybersecurity program and control environment.

Fusion & Security Operations (F&SO) is one of five functions that make up GCS. F&SO works to provide real-time knowledge of cyber threats of today collectively to better prepare State Street for threats of tomorrow.

This Cloud Detection Engineer I will sit in the Fusion Architecture & Detection Engineering sub-function in F&SO. This role is responsible for detecting possible cybersecurity attacks and compromises and sending cogent alerts for analysis by the security operations center. Other responsibility areas are listed below.

• Draft and deliver detection use cases in the Splunk Processing Language (SPL); Kusto Query Language (KQL); Falcon Query Language (FQL) and other security query languages.
• Draft and deliver Jira and Confluence pages about cloud detection use cases following prescribed business processes.
• Investigate threat reports and request for detections to determine if a new detection use case is warranted.
• Present production ready use cases to executive governing boards for review and approval.
• Write detection oriented business cases, project plans, and reasoned explanations for decisions made about detections to support the execution of detection engineering projects.
• Partners with technical and non-technical professionals to enhance detection functions, and to drive better protection and response.

• Highly diverse and relevant education and experiences, such as: ethical hacking, data analytics, law, military cyber operations, penetration testing, cyber defense, and cyber transformation program management.
• Broad knowledge of cyber security software, business processes, organizational structure, and challenges.
• Software development and scripting experience using RegEx, PERL, Python, or Powershell.
• Ability to create polished presentations in PowerPoint, PowerBI, or other data visualization tools.
• Experience at a large, multi-national financial services firm.
• Experience at a large, multi-national technology consulting firm.

• One year of experience in cybersecurity detection engineering gained through a Bachelor's (BSc) in STEM; or through employment or volunteering.
• Amazon Web Service (AWS) Solutions Architecture Associate, or Oracle Cloud Infrastructure (OCI) Architecture Associate, Certification.
• Knowledge of Oracle Cloud Infrastructure (OCI).
• Ability to code detection use cases using SPL, KQL, or FQL.
• Ability to use Splunk for detection engineering.
• Ability to perform data manipulation, analysis, and reporting using Python, r, or similar analytics language.
• Ability to use Structured Query Language (SQL).
• Knowledge of the cyber global threat landscape; cyber adversaries; cyber tactics, techniques, and procedures (TTPs); cyber threat intelligence sources and methods; and malware.
• Knowledge of infrastructure and application telemetry.
• Ability to use Jira and Confluence to develop, document, collaborate, and release use cases into production environments.
• Ability to write polished descriptive and persuasive business documents.
• Ability to craft reasoned explanations for decisions that can withstand audit scrutiny.