Detection Engineer/Endpoint Security Engineer

<p><strong>About Mitsogo | Hexnode</strong></p> <p>Hexnode is a global leader in Unified Endpoint Management (UEM), trusted by over 100 countries and managing millions of devices worldwide. With a rapid pace of innovation, we have established ourselves as a dominant force across Apple, Windows, Android, macOS, Linux, and tvOS. Fuelling the transformation to a seamless ecosystem of connected tools, Hexnode is revolutionizing the enterprise software and cybersecurity landscape.</p> <p><strong>Job Overview:</strong></p> <p><span data-contrast="none">We build Hexnode's XDR endpoint stack — a Windows kernel driver, Windows and macOS agents, and the server and console behind them. The driver and agents already emit a broad telemetry surface: process creation and termination, process access, image load, driver load, thread creation, registry key and value operations, network connections, DNS queries and file activity. We are actively extending the platform with advanced features.</span><span data-ccp-props="{"201341983":0,"335559739":120,"335559740":276}"> </span></p> <p><span data-contrast="none">Telemetry on its own catches nothing. This role exists to turn that telemetry into detections that fire on real adversary behaviour, prove they fire, and keep them quiet enough that an analyst trusts them. You will own detection content end to end: write the rule, emulate the technique, verify the telemetry supports it, tune out the false positives, and document what we cover and what we don't.</span><span data-ccp-props="{"201341983":0,"335559739":120,"335559740":276}"> </span></p> <p><span data-contrast="none">This is a hands-on engineering role, not an alert-queue role. You will spend your time in a lab with instrumented endpoints, in detection logic, and in the gap between what an attack does and what our sensors see.</span><span data-ccp-props="{"201341983":0,"335559739":120,"335559740":276}"> </span></p> <p><strong><span data-ccp-props="{"201341983":0,"335559739":120,"335559740":276}">Key Responsibilities:</span></strong></p> <p><span data-contrast="none"><span data-ccp-parastyle="heading 2">Detection content</span></span><span data-ccp-props="{"335559738":220,"335559739":90}"> :</span></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="1" data-aria-level="1"><span data-contrast="none">Author, tune and maintain detection rules for endpoint threats, and keep coverage mapped to MITRE ATT&CK.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="2" data-aria-level="1"><span data-contrast="none">Translate techniques into concrete detection logic against the events our driver and agent emit</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="3" data-aria-level="1"><span data-contrast="none">Retire and replace detections that no longer earn their keep.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p><span data-contrast="none"><span data-ccp-parastyle="heading 2">Adversary emulation and detection testing</span></span><span data-ccp-props="{"335559738":220,"335559739":90}"> :</span></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="4" data-aria-level="1"><span data-contrast="none">Build </span><em><span data-contrast="none">benign</span></em><span data-contrast="none"> emulations that reproduce the telemetry signature of a technique without shipping working offensive capability or live C2 into an internal build.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p><span data-contrast="none"><span data-ccp-parastyle="heading 2">Telemetry gap analysis</span></span><span data-ccp-props="{"335559738":220,"335559739":90}"> :</span></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="5" data-aria-level="1"><span data-contrast="none">Compare what a detection needs against what the agent and driver emit today, and write up concrete, implementable telemetry requests for the driver and agent teams.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="6" data-aria-level="1"><span data-contrast="none">Contribute to data-model decisions for endpoint events</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="7" data-aria-level="1"><span data-contrast="none">Flag where a proposed detection is not implementable with current sensors, early enough to change the plan.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p><span data-contrast="none"><span data-ccp-parastyle="heading 2">False positive reduction</span></span><span data-ccp-props="{"335559738":220,"335559739":90}"> :</span></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="8" data-aria-level="1"><span data-contrast="none">Triage alert noise from internal and customer telemetry; assemble false-positive candidates with evidence rather than anecdote.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="9" data-aria-level="1"><span data-contrast="none">Draft exclusion and whitelist filter logic and detection tuning, for review before deployment.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="10" data-aria-level="1"><span data-contrast="none">Help maintain the goodware corpus and prevalence gating that back our release-gate regression runs.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p><span data-contrast="none"><span data-ccp-parastyle="heading 2">Research and documentation</span></span><span data-ccp-props="{"335559738":220,"335559739":90}"> :</span></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="11" data-aria-level="1"><span data-contrast="none">Benchmark how competitors implement a given capability and write up the tradeoffs.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="12" data-aria-level="1"><span data-contrast="none">Maintain a living ATT&CK coverage matrix — the artifact that answers “what do we detect, and how do we know” without anyone guessing.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p><strong><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}">Requirements</span></strong></p> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="13" data-aria-level="1"><span data-contrast="none">2–4 years</span><span data-contrast="none"> in detection engineering, threat hunting, SOC L2/L3, or endpoint security product engineering.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="14" data-aria-level="1"><span data-contrast="none">Windows internals as they surface in telemetry</span><span data-contrast="none"> — processes, threads and handles; services; the registry; scheduled tasks; PE files and Authenticode signing; the Security event log and logon types; common LOLBins.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="15" data-aria-level="1"><span data-contrast="none">Sysmon or equivalent EDR telemetry</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="16" data-aria-level="1"><span data-contrast="none">Detection rule tuning</span><span data-contrast="none"> – </span><span data-contrast="none">You'd rather say “this rule will be noisy, here's its hit rate against our goodware corpus”</span><span data-contrast="none"> than ship it and find out from a customer.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="17" data-aria-level="1"><span data-contrast="none">MITRE ATT&CK fluency</span><span data-contrast="none"> — Can go from technique to detection logic to test case without being walked through it.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

<li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="18" data-aria-level="1"><span data-contrast="none">Scripting in PowerShell and Python</span><span data-contrast="none"> — enough to build own tooling, not just run someone else's.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

<li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="19" data-aria-level="1"><span data-contrast="none">Rule authoring, static PE analysis, and similarity hashing — imphash, ssdeep, TLSH.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="20" data-aria-level="1"><span data-contrast="none">Malware triage and unpacking.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="21" data-aria-level="1"><span data-contrast="none">Exposure to Microsoft's AV ecosystem — MVI, ELAM, AMSI, ETW Threat Intelligence — or to independent lab testing (AV-Comparatives, AV-TEST).</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="22" data-aria-level="1"><span data-contrast="none">macOS endpoint telemetry via the Endpoint Security framework.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <ul> <li data-leveltext="

• " data-font="" data-listid="1" data-list-defn-props="{"335552541":1,"335559685":431,"335559991":288,"469769242":[8226],"469777803":"left","469777804":"
• ","469777815":"hybridMultilevel"}" data-aria-posinset="23" data-aria-level="1"><span data-contrast="none">GitLab and Jira in a product engineering workflow.</span><span data-ccp-props="{"201341983":0,"335559739":70,"335559740":276}"> </span></li>

</ul> <p> </p>