Principal Security Engineer - Incident Response at JumpCloud
Sorry, this job was removed at 11:11 a.m. (MST) on Wednesday, September 15, 2021
All roles at JumpCloud are Remote in the U.S. unless otherwise specified in the Job Description.
Do you enjoy solving challenging problems using the latest technologies within a great team? Is knowing your work will be highly visible and mission critical a key component for the next step in your career? At JumpCloud, we’re looking for best-in-class talent to help define the future of modern identity and device management from the ground up.
JumpCloud’s mission is to Make Work Happen®, providing simple, secure access to corporate technology resources from any device, or any location. The JumpCloud Directory Platform gives IT, security operations, and DevOps a single, cloud-based solution to control and manage employee identities, their devices, and apply conditional access controls based on Zero Trust principals. JumpCloud has a global user base of more than 100,000 organizations, with over 4,000 customers including Cars.com, Grab, ClassPass, Uplight, Beyond Finance and Foursquare. JumpCloud is backed by BlackRock, General Atlantic, OpenView, and Foundry Group.
JumpCloud is looking for a Principal Security Engineer focusing on Incident Response to engineer, triage, respond and mitigate attacks across JumpCloud products and services. In this position, you will be a part of a flexible team responsible for handling security operations. As such, you'll need to have years of practical security experience in DFIR and knowledge of best practices for incident handling, security operations, detecting, and responding to attacks. You'll be someone JumpCloudians across the company depend on and trust to respond quickly and effectively in a crunch. Your outstanding communication and collaboration skills are essential to collaborating with diverse stakeholders. Most importantly, you will become a critical member of the team responsible for ensuring visibility across JumpCloud products and services and keeping our customers and service partners safe. About the Role: The Information Security Incident Response Lead is responsible for the management, operation, and direction of the incident response program, related process development, and improvement activities, including security breach simulation exercises. This individual will develop JumpCloud's Incident Response program and train and mentor others to perform and manage daily tasks associated with cyber incidents, investigations, threat intelligence, threat hunting, and simulation exercises as part of Security Operations. This individual will also drive new solutions, deployments, and procedures for gathering, handling, searching, and retrieving centralized log data, digital and physical evidence concerning incidents. Ensure that forensically sound practices are documented. As a SaaS provider, this role also should provide guidance and assistance to JumpCloud GRC and Vulnerability Management programs, as well as product security. This individual will coordinate processes and collaborate with Security Engineering, and other business stakeholders across the company, in daily security operations, as well as ensuring process continuity, disaster recovery, and business continuity in planned simulation exercises to demonstrate cyber resilience in the event of a cyber-attack or breach.
The company's leadership team, and a cross-functional team of skilled engineers from various perspectives, all working with a singular focus of maintaining our customer's trust. You'll be exposed to the reality of how JumpCloud functions on a technical and process level and will build a comprehensive base of knowledge around how it all works together. In doing so, you'll be playing a role in keeping JumpCloud secure and compliant, bringing security to our company's forefront.
- Execute, develop and document incident handling guides and processes for JumpCloud
- Lead the Security Incident Response Team (SIRT) to employ strategy, standards, processes, and technology to detect, respond and recover from security incidents and to limit the impact of any such occurrence
- Prioritizes events using existing tools to correlate data for the purpose of reducing false positives and detecting threats
- Analyze and tune security alerts and interpret events, as well as create new signals based on signatures and behavioral activities
- respond to security incidents, lead investigations, and perform forensics on IT systems as necessary. Guide/lead mitigation strategies for identified vulnerabilities and threats Design, automate and maintain a portfolio of security alerts, automated actions, and escalation workflows supporting a high-performing 24/7 incident response capability
- Conduct threat hunting activities, anticipate future threats and maintain forward-thinking strategies for tools/technology/processes that combat sophisticated threat actors
- Assist with implementation of counter-measures or mitigating controls Develop and maintain Incident Response capabilities in public cloud environments Prepare incident reports of analysis methodology and results. Recognize potential, successful, and unsuccessful intrusion attempts and compromises thorough reviews and analyses of relevant event detail and summary information
- Partner with key stakeholders and communicate effectively to continuously improve the feedback loop of preparation, identification, analysis, containment, and post mortem activities
- Develop monthly reporting dashboards and metrics on incidents and response capabilities Prepare executive summaries and conduct briefings on significant investigations. Developing the security event simulation program and conduct security event tabletop exercises
Qualifications And Skills
- Expertise in building and operating security information/event management systems (SIEM), centralized logging, and enrichment solutions(Endpoint protection/detection, Network telemetry data, ELK, Splunk, Snowflake, AWS services, HR systems, codebase infrastructure, build infrastructure).Practical experience working with cloud technologies; ability to build and deploy a solution using Terraform.
- Superb communication and leadership capacity; ability to partner effectively with diverse company stakeholders.
- Active and current knowledge of campaign behavior, Cyber Crime, IoCs, TTPs, and current threats
- Competency in integrating Threat data, enrichments, for higher-value outcomes and behavioral situational awareness.
- Views security as an enabler, not an inhibitor to innovation.
- Ownership and Accountability
- High Level of Integrity
- Clear Communication
- Creative Problem Solver
- Passionate about Security
In accordance with the Colorado Equal Pay for Equal Work Act, the approximate compensation range for this role is $180,000 to 220,000 including base salary and any related bonuses or commissions. JumpCloud provides comprehensive benefits, including medical, dental and vision insurance, short and long term disability, life insurance and a 401k savings plan. We have an unlimited vacation policy.
Where you’ll be working
All our roles are remote in the U.S. unless otherwise specified. Our Headquarters is in the Denver/Boulder, CO area. Once we reopen our offices you will have the opportunity to remain fully remote (in the U.S.), work from one of our office locations (CO only currently) or flex your time.
If you thrive working in a fast, SaaS-based environment and you are passionate about solving challenging technical problems, we look forward to hearing from you! JumpCloud is an incredible place to share and grow your expertise! You’ll work with amazing talent across each department who are passionate about our mission. We’re out of the box thinkers, so your unique ideas and approaches for conceiving a product and/or feature will be welcome. You’ll have a voice in the organization as you work with a seasoned executive team, a supportive board and in a proven market that our customers are excited about.
Please submit your résumé and brief explanation about yourself and why you would be a good fit for JumpCloud. Please note JumpCloud is not accepting third party resumes at this time.
We're an equal opportunity employer. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status.
Read Full Job Description