Information Security Engineer, Threat Disruption

We are seeking a Senior Information Security Engineer to join the Threat Disruption team within the Advanced Operational Services (AOS) organization. This role focuses on identifying, analyzing, and mitigating phishing threats while strengthening the organization’s overall security posture.

You will work on detecting and responding to cyber threats, conducting investigations, and developing scalable solutions to prevent security incidents. Responsibilities

• Analyze and correlate security logs using tools such as Splunk
• Lead phishing disruption efforts by developing detection logic and processes
• Investigate security incidents and perform digital forensics analysis
• Participate in incident response for moderately complex security events
• Identify root causes of incidents and recommend mitigation strategies
• Design, implement, and maintain security solutions across systems and networks
• Provide security guidance to internal teams to ensure compliance with policies
• Conduct vulnerability assessments and recommend remediation actions
• Collaborate with cross-functional teams to resolve security issues and improve defenses

• 4+ years of experience in Information Security Engineering or related field, or equivalent practical experience
• Experience with security monitoring and log analysis tools (e.g., Splunk)
• Understanding of phishing threats and general cybersecurity principles

Preferred Qualifications

• Experience detecting and mitigating phishing campaigns targeting users and brand assets
• Proficiency in writing regular expressions and YARA rules
• Experience in areas such as:
• Incident response
• Threat intelligence
• Vulnerability management
• Network/host forensics
• Cybercrime investigations
• DMARC and email security
• Hands-on experience with security tools (SIEM, IDS/IPS, endpoint, email/web gateways)
• Strong analytical and problem-solving skills with attention to detail
• Knowledge of adversarial techniques and threat hunting methodologies
• Ability to manage multiple priorities in a fast-paced environment
• GIAC or similar cybersecurity certifications
• Experience with system and application security hardening best practices