Job Responsibilities:
1. Promote the construction and optimization of the security and security operation center system, including but not limited to log collection, analysis, alarms, SOAR, and BAS;
2. Responsible for tracking and analyzing security issues and promoting the completion of closed-loop processing of security incidents;
3. Enrich and optimize existing alarm scenarios and rules to improve alarm quality;
4. Participate in daily emergency response to security incidents and security system maintenance;
5. Participate in building security testing capabilities for office networks, production networks, and cloud environments;
6. Participate in the company’s office security offensive and defensive confrontation to improve office security capabilities;
job requirements:
1. More than 10 years of security-related work experience, and those who have engaged in Web3-related work are preferred;
2. Be familiar with vulnerability management, writing and maintaining security baseline detection rules, understand the principles of common vulnerabilities, and have the ability to write POC and EXP codes for vulnerabilities;
3. Familiar with at least one language such as Python and Java, and have API system integration development capabilities;
4. Familiar with big data development tools such as SQL, ELK, Kafka, etc., have log analysis and processing capabilities, and can be combined with security risk data;
5. Be familiar with the threat detection operation ideas in office networks, production networks and other environments, and can set up systematic detection solutions according to scenarios;
6. Familiar with the configuration management and rule writing of common security products such as Sysmon, Osquery, and Wazuh; familiar with the main tactics and techniques of the ATT&CK attack matrix and able to convert them into detection rules;
7. Have experience in intrusion detection and emergency response, and be able to quickly locate, block, and defend security incidents;
8. Have the ability to discover vulnerabilities and be able to complete the entire penetration testing process independently.
Bonus Point:
1. Responsible for the complete R&D cycle of security defense products
2. Have in-depth understanding of offense and defense, and experience in actual combat with APT
3. Ability to analyze the behavior of malware samples in Windows/macOS/Linux environments
4.Able to communicate in different Language with teams based in Europe or China
