Senior Detection Engineer, Marriott Bonvoy

Marriott Bonvoy

Location:

Singapore, Singapore

Category:

IT - Software Development

Contract Type:

Employment contract

Salary:

Not provided

Save Job

Apply Position

Job Description:

This is a detection engineering role that leverages knowledge of monitoring, analyzing, detecting, and responding to cyber events and incidents to develop and implement effective monitoring and alerting for information systems and networks. This role is responsible for developing and tuning Security Information and Event Management (SIEM- Splunk) and User Entity and Behavior Analytics (UEBA - Exabeam) content to monitor critical IT infrastructure and application logged events to detect cybersecurity and insider threats across the Marriott enterprise. This role produces high-quality documentation pertaining to detection development, monitoring logic, and other content creation tasks. This role will also lead collaboration sessions for security monitoring use case ideation with partners in the cyber security tower and other business units.

Job Responsibility:

Lead collaboration sessions within the cyber security tower and other business units to devise security monitoring use cases
engage and collaborate with other security engineers and architects as needed to keep pace with the evolution of corporate infrastructure and applications and share that knowledge with peers as appropriate
document prospective security monitoring use cases with MITRE ATT&ACK mappings using standard templates and methodologies
inform and consult other cyber ops teams of required data onboarding and integrations for use case development
develop analytics, correlation searches, dashboards, reports and alerts within the SIEM and UEBA platforms
solicit feedback for pre-production security monitoring content through peer review process and user acceptance testing for tuning
document developed security monitoring content in a documentation registry using department standard templates and methodologies
manage field mapping and transmission of security monitoring alerts to the security incident response platform for SOC analyst consumption as outlined in process documentation
provide governance support for the content development function entailing content development standards compliance, change management approvals for SIEM or UEBA content, and lifecycle management of developed security monitoring content
service operational requests in queue such as analytics content performance tuning, filtering, search refinement, parsing issues
attend SCRUM and prioritization meetings to review and update deliverables.

Requirements:

Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification
3+ years of collective experience in Splunk SIEM (Splunk Enterprise Security) threat detection use case development or UEBA (Exabeam) use case development for insider threat use case development
5+ years of experience in security functions such as SOC, CIRT, security engineering, risk management, vulnerability management or technical infrastructure operations, administration, or systems engineering
scripting or programming language, including Python
Current information security certification such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP) preferred
offensive and defensive security certifications such as CEH, IGAC Cyber Defense, OSCP or other related certifications preferred
Splunk Certification, including Splunk Enterprise Security Certified Admin preferred
use case development experience on the Exabeam platform preferred
working knowledge of the NIST Cyber Security Framework and ISO/IEC 27001:2022 preferred
working knowledge of the MITRE ATT&CK Framework preferred
experience with security monitoring use case ideation for business applications and IT infrastructure preferred
familiarity with cloud service provider platforms (AWS, Azure, GCP), identity and access management systems, firewalls, next-gen anti-malware, intrusion detection and prevention systems preferred
experience with Linux, Unix and Microsoft operating systems preferred
knowledge of IP networking preferred
experience with a scripting language (*nix shell scripting, Python, PowerShell, etc.) and regular expressions preferred
solid written and verbal communication skills
agile methodology.

Nice to have:

Current information security certification such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP)
offensive and defensive security certifications such as CEH, IGAC Cyber Defense, OSCP or other related certifications
familiarity with cloud service provider platforms (AWS, Azure, GCP), identity and access management systems, firewalls, next-gen anti-malware, intrusion detection and prevention systems
working knowledge of the NIST Cyber Security Framework and ISO/IEC 27001:2022
working knowledge of the MITRE ATT&CK Framework
experience with security monitoring use case ideation for business applications and IT infrastructure
experience with Linux, Unix and Microsoft operating systems
knowledge of IP networking
experience with a scripting language (*nix shell scripting, Python, PowerShell, etc.) and regular expressions.

Additional Information:

Job Posted:

March 22, 2025

Employment Type:

Fulltime

Work Type:

On-site work

View All Jobs In This Company

Job Link Share:

Senior Detection Engineer