Company: Cloud.ru
Location: Saint Petersburg
Employment Type: Full-time
Skills: SIEM, Linux, Firewall.
Specialization: Security Engineer.
Responsibilities:
- Development and implementation of threat detection rules (creation, testing, optimization)
- Connecting and integrating new data sources (organizing connection, configuring parsers, filters, and data normalization)
- Forming hypotheses for Threat Hunting (data analysis, forming hypotheses/intake ideas)
- Documentation and support (content catalog: threat detection rules, connected sources, parsers)
- Monitoring and optimization of detection rules (FP analysis, noise reduction, audit and update of existing content, exception management)
We expect:
- Experience in information security (preferably in SOC)
- Understanding of SIEM system principles (ELK, MP, KUMA, etc.)
- Experience in writing and debugging detection rules
- Knowledge of the MITRE ATT&CK Framework and the ability to apply it in practice
- Experience with logs from various systems: OS (Windows, Linux), networks (Firewall, Proxy, DNS), EDR, applications
- Log parsing and normalization skills (regular expressions, grok patterns, JSON/XML parsing)
