Detection Engineering Tech Lead

必須

• Experience: 10+ years in Cyber Security, with at least 5+ years in Detection Engineering or Security Research.
• Detection Engineering: Deep expertise in building detection pipelines, tuning logic for high-fidelity alerts, and managing the security rule lifecycle.
• AI/ML/LLM Proficiency: Practical experience building/tuning models for anomaly detection and log analysis.
• Technical Depth: Expert-level coding skills (Python, Go, or Rust) and mastery of Linux/Windows/Mac internals.
• Container & K8s Security: Strong hands-on experience securing Kubernetes clusters, container runtimes, and microservices architectures.
• Domain Knowledge: Understanding of Telco networks/protocols (e.g., 5G core, signaling) and Network Security (packet analysis, perimeter/internal controls).
• Offensive Mindset: Experience in penetration testing, exploit development, or red teaming.
• Education: Bachelor's or Master's degree in Computer Science, Cyber Security, or equivalent.
• Certifications: Relevant certifications (e.g., OSCP, GREM, GCFA, CKS, BTL2, or AI-Security credentials).
• English (Overall - 3 - Advanced)

歓迎

• Experience with Infrastructure as Code (Terraform, Ansible, Crossplane).
• Deep experience with eBPF tools (e.g., Tetragon, Falco, Cilium, Spyderbat).
• Active contributor to open-source detection projects (e.g., Sigma, YARA, or custom AI-detection models).
• Experience in high-scale environments (Telco, Cloud-Native, or FinTech).

使用ツール

Job Duties

• Detection-as-Code (DaC) Transformation: Build and manage an end-to-end detection pipeline featuring peer reviews, version control (Git), and a reusable repository of detection rules.
• AI/LLM-Driven Detection: Architect and develop AI/LLM-based models to identify autonomous AI attacks. Use AI to automate log onboarding, normalize data, and filter "garbage logs" to drastically reduce SOC noise.
• Advanced Runtime Security: Lead the implementation of kernel-level monitoring using eBPF-based tools to provide deep visibility into containerized (K8s) and Linux-based workloads.
• Offensive Security & Threat Hunting: Perform continuous attack simulations (Red Teaming) to validate detection coverage. Lead proactive threat hunting initiatives informed by CTI and the MITRE ATT&CK/FIGHT frameworks.
• Deception & Defense-in-Depth: Deploy and manage deception technologies to create high-interaction traps. Ensure detection logic aligns with our defense-in-depth architecture.
• Cross-Functional Orchestration: Collaborate with DFIR, CTI, and SOC teams to ensure CTI is actively integrated into detection logic via AI-driven automation.
• AI Guardrails & Security: Oversee the security of our own AI/LLM models, implementing guardrails to prevent model poisoning, prompt injection, and adversarial manipulation.
• SOAR Integration: Partner with the SOC team to ensure detection logic feeds seamlessly into SOAR playbooks for machine-speed response.

Work Environment

• Department: Detection Engineering Section, Cyber Defense Operations.
• Collaboration: Work with diverse teams including security researchers, threat hunters, and AI/ML specialists.
• Tech Stack: Python/Go/Rust, Kubernetes, Linux, eBPF, Git/Sigma/YARA, LLM-integrated pipelines, SOAR, Terraform/Ansible.
• Location: Japan (Tokyo or Osaka). Domestic/overseas business travel and relocation may be required.