The posting
At Confluent, we’re creating a category that transforms how every company manages and streams data. Have you ever found a new favorite series on Netflix, picked up groceries curbside at Walmart, or paid for something using Square? That’s Confluent in action—giving our customers instant access to massive amounts of real-time data, enabling them to thrive in an ever-changing digital world. As one of the fastest-growing enterprise companies in history, and with Fortune 100 customers across major industries, we have a tremendous opportunity in front of us. We also have experience on our side. Our leaders have taken companies of our size to major success before and include some of the original creators of Apache Kafka®.
We’re looking for self-motivated team members who crave a challenge and feel energized to roll up their sleeves and help realize Confluent’s unlimited potential. Chart your own path and take healthy risks with the backing and support of our #OneTeam culture. Be part of inclusive initiatives like Employee Resource Groups and development programs, and take advantage of benefits that support our diverse global teams. Grow as we grow—whether you’re just starting out or managing a large team, you’ll be amazed at the magnitude of your impact.
Build and maintain scalable cloud-based security monitoring solutions, treating detections as code across logging pipelines, ETL jobs, and SIEM ingestion.
● Translate modern adversary tradecraft (TTPs) and threat models into high-signal detection strategies to ensure our critical infrastructure operates safely.
● Build processes and workflows to triage security alerts and drive incidents to closure, including participating in a shared on-call rotation for incident response.
● Research new threat attack vectors and ensure that our detection and response program is in line with the current threat landscape.
● Proactively improve the quality of our detection rules, working directly with engineering teams to eliminate classes of issues.
● Collaborate with engineering teams in building logging pipelines needed to gather relevant security telemetry.
● Contribute to risk management and prioritization efforts around detection and response.
● 4+ years of relevant industry experience.
● Strong domain knowledge in detection engineering and security incident response.
● Hands-on experience in instrumenting telemetry and building high-quality detections in large-scale deployments (e.g., Kubernetes, containers, multi-cloud).
● Ability to write code proficiently in Python or Golang.
● Experience with operating open-source and/or commercial solutions for logging and security event management (e.g. SIEM, log aggregation, SOAR, etc).
● Ability to work alongside a remote team, using a data-driven mindset to propose and own engineering decisions.
● Familiarity with more than one cloud vendor (AWS, GCP, Azure) is a plus.
