Head of Detection Engineering

Applications are accepted until further notice

Head of Detection Engineering

At Cisco Meraki, we know that technology can connect us, empower us, and drive us. By simplifying powerful technology we can free hardworking people to focus on their mission. As the fastest-growing cloud-managed networking team in the world, our products and technology architecture are changing the face of enterprise networking and making cloud-managed IT a reality!

Our Meraki Security organization provides critical cybersecurity and business protection to Meraki and our customers globally. Our mission is to earn and maintain customer trust by protecting, defending, and improving the security of Meraki products, systems, and services. In order to support a global customer base, the Meraki Detection Engineering Team is a fully remote team with employees in multiple locations and time zones.

As a direct report of the Head of Threat Management, you will be responsible for leading Cisco Meraki’s Detection Engineering program. You will be responsible for helping build, maintain, and improve our threat detections and alerting infrastructure. You will also be responsible for ensuring Meraki Security has the right data collection and log visibility in place to discover threats against our infrastructure, data, employees, and customers. We are looking for engineers who are self-starters, curious, and are comfortable operating in environments where there are lots of unknowns.. This position will require frequent collaboration with the other Threat Management capabilities, including Threat Response, Insider Threat, and Threat Intelligence.

The program you run will have a direct, immediate, and positive impact on our internal security, external customers, and the hundreds of millions of users that use and rely on Meraki access points, switches, security appliances, and cameras every single day. We are passionate about building real products that our customers love. We believe in fostering a positive culture by hiring, mentor, and empowering thoughtful, conducive, humble people. With the support of management, we constantly look within for ways to improve organizationally. Finally, we maintain a positive relationship with Cisco that gives us the stability and resources of a larger company without sacrificing our startup vibe!

Key responsibilities:

• Oversee the strategic planning, execution, and continuous improvement of the detection engineering program.
• Develop and report on key performance metrics to track the effectiveness and maturity of the Detection Engineering program.
• Lead and mentor a team of two contractors ensuring alignment with program goals.
• Liaison with other Cisco Security teams and business units doing similar Detection and Response work
• Ideate, design, develop, test, monitor, and tune high-quality detections to ensure our security analysts can respond effectively to security threats.
• Write complete and well-documented alerting and detection strategies to provide necessary context and runbooks for security analysts and incident responders.
• Serve as a subject matter expert for security-relevant logs and data, assisting the Incident Response team during high-priority investigations.
• Build, maintain, and improve custom detection and alerting solutions, ensuring commercial tools are optimized to meet detection coverage needs.
• Collaborate with the Threat Intelligence team to build impactful detections that enhance Meraki’s security posture.
• Work closely with the Insider Threat team to develop and implement strategies for detecting and mitigating insider threats.
• Support other security program initiatives to improve the Threat Management team’s security visibility.
• Independently propose logging modifications and improvements to other Engineering and Software Development teams to ensure the necessary detections can be built

You are an ideal candidate if you have:

• Proven hands-on experience with full-lifecycle detection engineering in support of a security operations team
• Knowledge and interest in the use of AI in detection engineering workflows
• Experience with defining, collecting, and analyzing various metrics that exhibit the purpose and success of a maturing Detection Engineering program (i.e. MITRE ATT&CK coverage)
• Experience building and managing high-performing security programs and teams
• Experience as a Threat Hunter, Security Operations Analyst, or Incident Responder
• Comfortability operating in Splunk or other common SIEM and SOAR solutions
• Technical depth in one or more of the following specialties: offensive security, application security, cloud security, digital forensics, malware analysis, threat hunting, incident response or some combination thereof
• Familiarity with SQL, relational databases, and data warehousing
• Basic Python (or other scripting language) experience in order to automate tasks within our case management and CI/CD environment
• Demonstrated knowledge of threat actor techniques, vulnerabilities, and exploits, and how those present themselves within logs and various endpoint/network artifacts
• Excellent communication and collaboration skills, with the ability to work with a high degree of autonomy.

Bonus points for:

• Relevant industry certifications
• Formal software engineering, DevOps, or data science experience from prior jobs, trainings, or academia
• Hands-on experience building tools and solutions within a public cloud environment, preferably AWS
• Splunk engineering/administration experience
• Experience with PCI-DSS, FedRAMP, and other compliance frameworks and their associated logging and detection requirements

Cisco is an Affirmative Action and Equal Opportunity Employer and all qualified applicants will receive consideration for employment without regard to race, color, religion, gender, sexual orientation, national origin, genetic information, age, disability, veteran status, or any other legally protected basis. Cisco will consider for employment, on a case by case basis, qualified applicants with arrest and conviction records.

At Cisco Meraki, we’re challenging the status quo with the power of diversity, inclusion, and collaboration. When we connect different perspectives, we can imagine new possibilities, inspire innovation, and release the full potential of our people. We’re building an employee experience that includes appreciation, belonging, growth, and purpose for everyone.