Detection Engineering & Threat Hunting Lead

Marvell Technology

Full-time - Senior

1,001-5,000 employees

Computer and Electronic Product Manufacturing

About the position

The Detection Engineering and Threat Hunt Lead at Marvell is a senior-level role focused on identifying and responding to cyber threats. This position is integral to the Security Operations Center (SOC), which operates 24/7 to detect, assess, and respond to security threats globally. The role involves threat hunting, developing detection logic, and creating response playbooks to enhance Marvell's cybersecurity capabilities.

Responsibilities

• Identify and respond to cyber threats against Marvell.
• Advise IT and business stakeholders on immediate actions based on threat trends.
• Adjust detection engineering priorities according to the current threat landscape.
• Correlate threat data from various sources with environmental context and the ATT&CK matrix to produce threat intelligence.
• Validate actionable items and communicate validated threats to the SOC for appropriate action.
• Conduct threat hunting and forensic analysis to discover new threats.
• Test existing detection logic for gaps and identify ways adversaries might evade detection.
• Provide expert threat analysis support to the Cyber Security Incident Response Team (CSIRT) and Global SOC.
• Research actors and tactics to enhance SOC detection capabilities.
• Produce tailored threat reports for stakeholders throughout the company.
• Collaborate with SIEM and SOAR engineering teams to turn hunting hypotheses into production detection cases.

Requirements

• 8+ years' experience in security-relevant domains, including 5+ years as a SOC Analyst or Network Analyst with a security focus.
• Experience in a large enterprise environment (preferably > 5000 employees).
• Strong communication skills with the ability to adapt messages for various audiences.
• Deep understanding of MITRE ATT&CK and experience building detection cases and playbooks.
• Proficient technical writing skills for documenting processes and procedures.
• Ability to solve problems and work through ambiguity.
• Proficiency in scripting languages such as PowerShell, Bash, and Python.
• Experience with SIEM query languages and technologies like IDS/IPS, NGFW, EDR, and Vulnerability Scanners.
• Expert understanding of common and emerging security threats and vulnerabilities.
• Self-motivated with a proven ability to deliver end-to-end solutions in a fast-paced environment.
• Industry security certifications such as CISSP and relevant GIAC certifications are highly desirable.
• Understanding of NIST Cyber Security Framework and its application in an enterprise environment.

Nice-to-haves

• Experience working with geographically diverse teams across multiple time zones.
• Familiarity with IT service management processes in an enterprise-level organization.

Benefits

• Flexible time off
• 401k
• Year-end shutdown
• Floating holidays
• Paid time off to volunteer
• Hybrid work model allowing work from home and on-site.