REMOTE USA March 19, 2025 Svitla Systems Inc. is looking for a Senior Cyber Threat Detection Engineer for a full-time position (40 hours per week) in the USA. Our client is an American multinational company that operates, franchises, and licenses lodging, including hotel, residential, and timeshare properties. It’s also the largest hotel chain in the world in terms of the number of available rooms. The company is based in Bethesda, Maryland, USA, and encompasses a portfolio of nearly 8,300 properties under 30 leading brands spanning 138 countries and territories. This detection engineering role leverages knowledge of monitoring, analyzing, detecting, and responding to cyber events and incidents to develop and implement effective monitoring and alerting for information systems and networks. This role is responsible for developing and tuning Security Information and Event Management (SIEM) and User Entity and Behavior Analytics (UEBA) content to monitor critical IT infrastructure and application-logged events to detect cybersecurity and insider threats across the enterprise. This role produces high-quality documentation about detection development, monitoring logic, and other content creation tasks. This role will also lead collaboration sessions for security monitoring use case ideation with partners in the cyber security tower and other business units. REQUIREMENTS Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification 7+ years of experience in Information Technology/Security 3+ years of collective experience in one or all of the following: o Splunk SIEM (Splunk Enterprise Security) threat detection use case development o UEBA use case development for insider threat use case development 5+ years of experience in some or all of the following: Experience working in (or with) security functions such as SOC, CIRT, security engineering, risk management, vulnerability management. Technical infrastructure operations, administration, or systems engineering o Scripting or programming language, including Python Experience with Amazon Athena, particularly in the context of security monitoring and threat detection use cases. NICE TO HAVE Current information security certifications include Certified Information Security Manager (CISM) and Certified Information Systems Security Professional (CISSP). Offensive and defensive security certifications, including CEH, IGAC Cyber Defense, OSCP, and other related certifications. Splunk Certification, including Splunk Enterprise Security Certified Admin. Understanding of using case development on the Exabeam platform. Knowledge of the NIST Cyber Security Framework and ISO/IEC 27001:2022. Knowledge of the MITRE ATT&CK Framework. Experience with security monitoring use case ideation for business applications and IT infrastructure. Familiarity with cloud service provider platforms (AWS, Azure, GCP), identity and access management systems, firewalls, next-gen anti-malware, intrusion detection and prevention systems. Experience with Linux, Unix, and Microsoft operating systems. Knowledge of IP networking. Experience with a scripting language (nix-shell scripting, Python, PowerShell, etc.) and regular expressions. Solid written and verbal communication skills. Knowledge of Agile methodology. RESPONSIBILITIES Lead collaboration sessions within the cyber security tower and other business units to devise security monitoring use cases. This work entails collecting and collaboratively analyzing security accreditation reports, threat models, documented security controls, architecture, and business usage patterns for security monitoring consideration. Engage and collaborate with other security engineers and architects to keep pace with the evolution of corporate infrastructure and applications, sharing knowledge with peers as appropriate. Document prospective security monitoring use cases with MITRE ATT&ACK mappings using standard templates and methodologies. Identify use cases that will be reviewed with stakeholders for acceptance sign-off and to move forward with development. Inform and consult other cyber ops teams on the required data onboarding and integrations for use case development. Develop analytics, correlation searches, dashboards, reports, and alerts within the SIEM and UEBA platforms. Solicit feedback for pre-production security monitoring content through the peer review process and user acceptance testing for tuning. Document developed security monitoring content in a documentation registry using department standard templates and methodologies. As outlined in the process documentation, manage field mapping and transmit security monitoring alerts to the security incident response platform for SOC analyst consumption. Provide governance support for the content development function, including compliance with content development standards, change management approvals for SIEM or UEBA content, and lifecycle management of developed security monitoring content. Create service operational requests in the queue, such as tuning analytics content performance, filtering, search refinement, parsing issues, etc. Attend Scrum and prioritization meetings to review and update deliverables. Develops and sustains relationships based on understanding customer/stakeholder needs and actions consistent with the company’s service standards. Support employees and business partners with diverse styles, abilities, motivations, and/or cultural perspectives; utilize differences to drive innovation and engagement and enhance business results; and ensure employees can contribute to their full potential. WE OFFER Competitive compensation based on skills and experience. Flexibility in the workspace and remote-friendly culture. Free webinars, meetups and conferences organized by Svitla. Personalized learning program tailored to your interests and skill development. Awesome team, friendly and supportive community! ABOUT SVITLA Svitla Systems is a global digital solutions company headquartered in California, with business and development offices throughout the US, Latin America, Europe, and Asia. Svitla is an outspoken advocate of workplace flexibility, best known for its well-established remote culture, individual approach to our teammate’s professional and personal growth, and trustworthy environment. Since 2003, Svitla has served a wide range of clients, from innovative start-ups in California to mega-large corporations such as Ingenico, Amplience, InvoiceASAP and Global Citizen. At Svitla, developers work with clients’ teams directly, building lasting and successful partnerships, as a result of seamless integration with on-site processes. Svitla Systems’ global mission is to build a business that contributes to the well-being of our partners, personnel and their families, improves our communities, and makes a lasting difference in the world. Join us! If you are interested in our vacancy, please send your CV. We will be happy to see you in our friendly team :) LET'S MEET IN PERSON Khrystyna Rabinchuk RECRUITER Email: [email protected] Skype: live:.cid.a64915742a54d385 LinkedIn: Khrystyna Rabinchuk Why hesitate? Apply now Tell us briefly about your project, and we will contact you within a day.