Note: The job is a remote job and is open to candidates in USA. ExtraHop is on a mission to protect and empower the connected enterprise, ensuring the integrity of networks, data, systems, and processes. As a Product Security Analyst, you will strengthen the security posture of ExtraHop’s cyber security products, collaborating across teams to define and run security operations and incident response.
Responsibilities
- Work with security information & event management (SIEM), endpoint detection & response (EDR), network detection & response (NDR) tooling and other systems to perform security investigations
- Operate and improve SIEM, EDR, NDR and others tools; implement, evaluate and tune detection rules
- Implement tools and scripts to automate monitoring and response activities
- Perform and/or lead security incident response activities
- Perform threat hunting activities to proactively assess system activity and search for indicators of compromise
- Participate in an on-call rotation with occasional after-hours paging to review carefully prioritized security detections
- Contribute to vulnerability detection and response pipelines, including tools, reporting and tracking
- Triage vulnerabilities; recommend and coordinate remediation actions
- Collaborate with Product Security team members to contribute to standards, policies, procedures, documentation, and training
- Other duties as assigned
Skills
- 4+ years of experience in cyber security or closely related roles
- 2+ years of which should be hands-on experience specifically fulfilling security monitoring, threat hunting and incident response duties
- Bachelor's degree or equivalent experience in a related field such as Cybersecurity, Computer Science, Information Systems, Engineering or other technical field
- Direct experience with a modern SIEM platform, including creating dashboards and searches, tuning detections, and responding to alerts
- Direct experience with server endpoint detection & response (EDR)
- Technical knowledge of Linux systems, web application security and cloud security, including security principles and best practices for cloud-based environments
- Proficient with security tools, including vulnerability scanners, ticketing systems
- Proficient with developing and refining Python code to integrate systems and automate response tasks
- Strong analytical skills to effectively manage and resolve security issues
- Proven ability to communicate complex security concepts
- Must be a U.S. citizen or national, U.S. permanent resident (current Green Card holder) or lawfully admitted into the U.S. as a refugee or granted asylum
- Note: employees, including fully remote staff, are expected to attend two in-person events every year. These events are typically held in our offices in downtown Seattle and run 4-5 days each
- Direct experience with Splunk Enterprise Security, Crowdstrike Falcon, and ExtraHop RevealX NDR
- Experience with Amazon Web Services (AWS), Google Cloud Platform (GCP), and common compute services and data stores
- Experience working with container-based environments (Kubernetes, Docker, etc.)
- Holds one or more security certifications
Benefits
- Health, Dental, and Vision Benefits
- Flexible PTO, Sick Time Prorated Based on Date of Hire, and All Federal Holidays (US Only) + 3 Days of Paid Volunteer Time
- Non-Commissioned Positions may be eligible to participate in the Annual Discretionary Bonus Plan
- FSA and Dependent Care Accounts + EAP, where applicable
- Educational Reimbursement
- 401k with Employer Match or Pension where applicable
- Pet Insurance (US Only)
- Parental Leave (US Only)
- Hybrid and Remote Work Model
Company Overview