Security Engineer II

• As a Security Engineer you ll be a key Player of a growing team chartered with improving and maturing the security poster of Expedia Group while protecting corporate & traveler data. Your work will be instrumental in, not only, improving the security of company but testing cycle times but also in ensuring that all solutions complement one another and function seamlessly.
• The ideal candidate would be open to new challenges, be extremely good at multi-tasking, be innovative, creative, disciplined and an outstanding teammate. The candidate would be comfortable driving continuous process improvement and collaborating effectively across teams to take on problems and implement new solutions.

What You ll Do:

• You ll be responsible to for smooth overall daily operations of the CSIRT 24/7 security support.
• Flexibility as the position will require shifts to cover 24x7 follow the sun in lined with US team.
• Responsible for the immediate escalation of Security issues ensuring adherence to SLAs and driving resolution/mitigation.
• Monitoring of security processes and technologies that reduce or remove security related risk in support of the enterprise and in compliance with regulatory requirements.
• You ll support all aspects of a security event monitoring and incident response process.
• You will seek continuous improvement of security events and proactively oversees research to identify emerging threats.
• Work with leadership to implement and maintain standards and procedures to drive efficiencies and security objectives.
• Responsible for security event monitoring generated by security tools.
• Oversee network traffic and security events to identify malicious activity.
• Provide support for security-related projects as assigned

• EDR investigation and Phishing email investigations
• Basic understanding of cloud platforms: AWS, Azure, GCP.
• Advance level data analysis experience with WAF, IDS/IPS, Full Packet Capture and Host/Network/Memory Forensics
• Advance knowledge with the development of security policies, procedures, guidelines, etc
• Enterprise-level experience performing incident triage, analysis, incident response, and remediation for computer network intrusions, web application and server attacks, insider threats, and malware infections.
• Extensive understanding of the life cycle of cyber threats, attacks, attack vectors and methods of exploitation.
• In-depth experience reviewing and creating timelines high volumes of logs, network data, attack artifacts, security events and device logs from large corporate LAN/WAN network devices including Firewalls/Switches/Routers, Databases, Anti-Virus, Intrusion Detection Systems (IDS), Web Proxys, and Domain Name Servers (DNS)
• In-depth experience developing content in enterprise SIEM (Security Information and Event Managers) platforms
• Knowledge of adversary activities in cyber security with an understanding of intrusion set tactics, techniques, and procedures
• Excellent verbal and written communication skills.
• Able to work with sensitive materials and employee information and maintain confidentiality at all times.