2nd Line Threat Hunter & Detection Engineer

As a 2nd Line Threat Hunter & Detection Engineer at Vattenfall, you will play a crucial role in developing the company's ability to detect, analyze, and stop advanced cyber threats. You will combine proactive threat hunting with detection development, enhancing the organization's resilience against current and future threats.

Responsibilities:

• Conduct proactive threat hunting based on hypotheses, threat intelligence, and relevant industry attacks.
• Identify suspicious activity not captured by existing detections and convert findings into new or improved detections.
• Analyze logs, network traffic, endpoint data, and security events to identify anomalies and attack patterns.
• Document findings and recommend relevant improvements.

Detection Engineering:

• Develop, test, and maintain detection rules and use cases for SIEM.
• Map and develop detections based on MITRE ATT&CK.
• Evaluate detection quality, reduce false positives, and contribute to detection automation.

Incident Analysis and Development:

• Support SOC and Incident Response during complex security incidents.
• Conduct post-incident analyses to identify gaps and improvement opportunities.
• Collaborate with Incident Response functions to enhance detection capabilities.

Qualifications:

• Several years of experience in Security Operations, Threat Hunting, or Detection Engineering.
• Practical experience with SIEM and Endpoint Detection & Response (EDR).
• In-depth knowledge of Windows and Linux environments from an IT security perspective.
• Experience with detection rule development and MITRE ATT&CK.
• Strong analytical and communication skills in Swedish and English.

Additional Information:

• Vattenfall offers a dynamic work environment with opportunities for growth and development.
• Benefits include flexible work arrangements, work-from-home options, and various employee perks.