Lead Security Engineer

ADP is hiring a Lead Security Engineer

• Do you have a passion for going on the offensive to safeguard critical information?

Well, this may be the role for you. Ready to make your mark?

In this role, the Lead Security Engineer will be responsible for the design, development, enhancement, and maintenance of the Threat Intelligence Program’s Platform Operations, Automation, and Integrations. The Lead Engineer will demonstrate the ability to perform in a fast-paced team, technical expertise, and leadership in threat intelligence, application development, brand protection, and data analysis.

You will work alongside infrastructure security engineers, threat intelligence analysts, threat hunters, and the security operations team to help improve our current automation processes and future integrations. You will work with various intelligence collection, reporting tools, and frameworks to automate the processes, develop playbooks, and/or integrate processes with other platforms. You will review documentation, develop plans, catalog and document processes, communicate with stakeholders and application support teams, follow up on requests, and improve processes.

To thrive in this position, you'll need to be an expert in application development, API integration, automation processes, understand the Threat Intelligence Lifecycle, and know how threat intelligence products and services work. You'll also need experience working with structured and unstructured data and are great at maintaining situation awareness. You know how to work with the Security Operations team to create the most value and identify gaps in available intelligence information and engage with leadership on strategies to meet intelligence requirements through Intelligence collection processes.

RESPONSIBILITIES:

• Develop Indicator Enhancement/Enrichment Playbook for the Threat Intelligence Platform (TIP).
• Collect and ingest data from various sources to the TIP.
• Develop systems integration between multiple Threat Intelligence Source APIs and the TIP to ingest indicators of compromise.
• Develop threat intelligence data dashboards, based on various tagging, and indicator types along with their threat severity and confidence levels.
• Develop and maintain API connections with various security stack solutions.
• Understand and maintain API that enables the system integration between Apache Nifi and the indicators database (mirror of the Threat Intelligence Platform Database). This API handles requests to build IOC feeds based on indicator types, indicator attributes or tags, and indicators severity, and handles the enrichment of indicators.
• Develop and maintain threat intelligence system to gather IOC data from multiple external threat intelligence feeds.
• Collect, review, and analyze internal, open source, and dark web datasets to integrate with TIP and other security monitoring solutions.
• Apply knowledge of current cyber threats and the associated tactics, techniques, and procedures used to infiltrate computer networks.
• Understand and maintain VPN infrastructure.
• Understand and maintain email servers used to deliver notifications and automated projects.
• Provide accurate and priority-driven analysis on cyber activity/threats and present complex operational/technical topics to senior managers and stakeholders.
• Establish and maintain excellent working relationships/partnerships with the cyber security and infrastructure support teams throughout the organization, as well as different business segments.
• Ability to develop processes, scripts, and code in a quick manner to support current operations and to improve automation processes.
• Ability to work in a fast-paced environment with minimal supervision
• Collect, analyze, investigate, store, and disseminate threat intelligence (actors, campaigns, TTPs, IOAs, IOCs).
• Conduct detailed technical analysis supported by industry-accepted threat intelligence analytical frameworks, tools, and standards.
• Create and evaluate trend/correlation analysis for scenario forecasting at both the tactical and operational levels.
• Develop and refine cyber-threat intelligence collection and analysis processes.
• Generate presentations that illustrate research through visualizations, charts, graphs, infographics, and evidence capture for senior leadership.
• Provide input for developing objectives, key results, and program metrics.
• Exhibit strong critical thinking and problem-solving skills with sound judgment.
• Maintain or develop professional contacts in the various communities to support operations.
• Support the Critical Incident Response Center (CIRC)/SOC with intelligence collection, analysis, and/or dissemination as it relates to ongoing investigations

QUALIFICATIONS REQUIRED:

• Excellent communications skills and report-writing capability
• Firm understanding and implementation of Software Development Life Cycle (SDLC) processes and executions.
• Firm understanding of programming languages: Python, Perl, PHP, Java, .net, and C.
• Good understanding of JQuery/Javascript web client applications.
• Firm understanding of database infrastructure development and management (PostgreSQL, MySQL, etc.) and NOSQL (MongoDB, DocumentDB, Elasticsearch, etc.) databases.
• Firm understanding of STIX/TAXII formats and integration with security stack.
• 8+ years of cybersecurity, threat intelligence, or network security experience; experience can include one or more of the following cyber-security functions: Cyber Threat Intelligence, Threat Hunting, System Administration, Intrusion Detection/Prevention, Monitoring, Incident Response, Digital Forensics, Vulnerability Management.
• Firm understanding of network security concepts, including threat and risk analysis, security event/incident monitoring, asset and risk management, and intrusion detection and prevention sensors.
• Experienced configuring both Windows and Linux networks.
• Prior experience as a technical cyber threat intelligence (or related) subject matter expert that has worked across organizational boundaries to analyze cyber threats to their organization’s infrastructure and services.
• A strong understanding of the cyber security principles, methodologies and best practices including knowledge of common threats, attack vectors, zero-days and exploitation techniques.
• A strong understanding of the Threat Intelligence terminology, the threat intelligence life cycle (cyber threat intel collection, data processing, analysis and findings reporting).
• Familiar with Threat Intelligence tools, platforms, and technologies e.g.: Threat Intelligence Platforms, SIEM, WAF, Etc.
• Experience writing code in any programming language (Python Prog Language knowledge desirable) for tasks automation and data manipulation.
• Knowledge about network protocols, log analysis and simple data structures (JSON, YAML, CSV, XML, Parquet, etc.) and data transformation across these popular data structures using programming languages.
• Proficiency developing and orchestrating automations threat intelligence life cycle writing code that can handle collection, data analysis and interpretation from various sources to identify potential threats and assess relevance to the organization.

A college degree is great but not required. What's more important is having the skills and experience to do the job.

WHAT YOU'LL DO:

Here's what you can expect on a typical day in the life of a Lead Security Engineer at ADP.

• Working in two-week sprints, you must keep up with timelines and coding standards.
• Variety of work. There is no typical day. You could be working on anything from migrations to delivering new features, product enhancements, or creating new services.
• You’re always learning new codes and operating with a "figure it out" mentality.
• You’re comfortable working on products with tech that has never been used before. Inevitable challenges will arise, and we'll rely on you to look for a solution.

Preference will be given to candidates who have the following:

• Knowledge of advanced cyber threats, threat vectors, and attacker methodology to include tools, tactics, and procedures and how they tie into the Cyber Kill Chain or ATT&CK framework.
• Experience in threat detection and analysis solutions.
• Knowledge of cloud services, infrastructure, and operations.
• Experience with premium threat intelligence tooling and/or open-source intelligence techniques.
• Experience with TIP automation development, collection, maintenance, and integrations.
• Experience with disseminating information in accordance with TLP classification and handling protocols to the sector through the appropriate mechanisms.
• Organizational and self-directing skills -- ability to initiate, coordinate and prioritize responsibilities and follow through on tasks to completion
• Experience with developing tools to enhance cyber-threat intelligence capabilities.
• Security operations experience in the financial industry.
• Snowflake
• MongoDB
• Redis (Data Caching System)
• Any AMQS (Advanced Message Queuing System) e.g.: Apache Kafka, RabbitMQ, etc.

Diversity, Equity, Inclusion & Equal Employment Opportunity at ADP: ADP is committed to an inclusive, diverse and equitable workplace, and is further committed to providing equal employment opportunities regardless of any protected characteristic including: race, color, genetic information, creed, national origin, religion, sex, affectional or sexual orientation, gender identity or expression, lawful alien status, ancestry, age, marital status, protected veteran status or disability. Hiring decisions are based upon ADP’s operating needs, and applicant merit including, but not limited to, qualifications, experience, ability, availability, cooperation, and job performance.

Ethics at ADP: ADP has a long, proud history of conducting business with the highest ethical standards and full compliance with all applicable laws. We also expect our people to uphold our values with the highest level of integrity and behave in a manner that fosters an honest and respectful workplace.