Senior Security Engineer - Threat Detection

JOB SUMMARY   This is a Senior Detection Engineering role that leverages knowledge of monitoring, analyzing, detecting, and responding to cyber events and incidents to develop and implement effective monitoring and alerting for information systems and networks.  This role is responsible for developing and tuning Security Information and Event Management (SIEM) and User Entity and Behavior Analytics (UEBA) content to monitor critical IT infrastructure and application logged events to detect cybersecurity and insider threats across the Marriott enterprise.  This role produces high-quality documentation pertaining to detection development, monitoring logic, and other content creation tasks.  This role will also lead collaboration sessions for security monitoring use case ideation with partners in the cyber security tower and other business units.

 

CANDIDATE PROFILE

Education and Experience

Required:

•    7+ years of experience in Information Technology/Security
•    3+ years of collective experience in one or all of the following:

o    Splunk SIEM (Splunk Enterprise Security) threat detection use case development
o    UEBA use case development for insider threat use case development

•    5+ years of experience in some or all of the following:

o    Experience working in (or with) security functions such as SOC, CIRT, security engineering, risk management, vulnerability management.
o    Technical infrastructure operations, administration, or systems engineering
o    Scripting or programming language, including Python

Preferred:

•    Current information security certification such as Certified Information Security Manager (CISM), Certified Information Systems Security Professional (CISSP)
•    Offensive and defensive security certifications such as CEH, IGAC Cyber Defense, OSCP or other related certifications
•    Splunk Certification, including Splunk Enterprise Security Certified Admin
•    Use case development experience on the Exabeam platform
•    Working knowledge of the NIST Cyber Security Framework and ISO/IEC 27001:2022
•    Working knowledge of the MITRE ATT&CK Framework
•    Experience with security monitoring use case ideation for business applications and IT infrastructure
•    Familiarity with cloud service provider platforms (AWS, Azure, GCP), identity and access management systems, firewalls, next-gen anti-malware, intrusion detection and prevention systems
•    Experience with Linux, Unix and Microsoft operating systems
•    Knowledge of IP networking
•    Experience with a scripting language (*nix shell scripting, Python, PowerShell, etc.) and regular expressions
•    Agile methodology

CORE WORK ACTIVITIES

Most Often:

•    Lead collaboration sessions within the cyber security tower and other business units to devise security monitoring use cases.  This work entails the collection and collaborative analysis of security accreditation reports, threat models, documented security controls, architecture, and business usage patterns for security monitoring consideration.
•    Engage and collaborate with other security engineers and architects as needed to keep pace with the evolution of corporate infrastructure and applications and share that knowledge with peers as appropriate.
•    Document prospective security monitoring use cases with MITRE ATT&ACK mappings using standard templates and methodologies.  Identified use cases will be reviewed with stakeholders for acceptance sign-off and to move forward with development.
•    Inform and consult other cyber ops teams of required data onboarding and integrations for use case development.
•    Develop analytics, correlation searches, dashboards, reports and alerts within the SIEM and UEBA platforms.
•    Solicit feedback for pre-production security monitoring content through peer review process and user acceptance testing for tuning.
•    Document developed security monitoring content in a documentation registry using department standard templates and methodologies.
•    Manage field mapping and transmission of security monitoring alerts to the security incident response platform for SOC analyst consumption as outlined in process documentation.
•    Provide governance support for the content development function entailing content development standards compliance, change management approvals for SIEM or UEBA content, and lifecycle management of developed security monitoring content.
•    Service operational requests in queue such as analytics content performance tuning, filtering, search refinement, parsing issues, etc.
•    Attend SCRUM and prioritization meetings to review and update deliverables.

Less Often:

•    Contribute to ongoing development and maintenance of documented standards, workflows, and best practices within the cyber threat detection engineering discipline.
•    Research emerging threats and adversary tactics, techniques, and procedures to understand the threat landscape and to ensure that security monitoring content remains relevant and effective.
•    Occasional participation in evaluations of new platforms, technologies and methodologies pertaining to cyber threat detection engineering.

 

The salary range for this position is $98,500 to $160,300 annually. In addition to the annual salary, the position will be eligible to receive an annual bonus.

Washington Applicants Only: Employees will accrue 0.04616 PTO balance for every hour worked and eligible to receive minimum of 7 holidays annually.

All locations offer coverage for medical, dental, vision, health care flexible spending account, dependent care flexible spending account, life insurance, disability insurance, accident insurance, adoption expense reimbursements, paid parental leave, educational assistance, 401(k) plan, stock purchase plan, discounts at Marriott properties, commuter benefits, employee assistance plan, and childcare discounts.  Benefits are subject to terms and conditions, which may include rules regarding eligibility, enrollment, waiting period, contribution, benefit limits, election changes, benefit exclusions, and others.

Marriott HQ is committed to a hybrid work environment that enables associates to Be connected.  Headquarters-based positions are considered hybrid, for candidates within a commuting distance to Bethesda, MD;  candidates outside of commuting distance to Bethesda, MD will be considered for Remote positions.

The application deadline for this position is 28 days after the date of this posting, March 4, 2025.
 

Marriott International is an equal opportunity employer. We believe in hiring a diverse workforce and sustaining an inclusive, people-first culture. We are committed to non-discrimination on any protected basis, such as disability and veteran status, or any other basis covered under applicable law.