We are looking for a Data Operations Engineer to help collect intelligence from many sources in the “threat actor space.” This data collection includes terabytes of data dumps that are shared and trafficked underground, as well as hundreds of dark web forums, markets for stolen goods, and ransomware sites.
You will be responsible for data collection and operational data engineering on data dumps and “malware logs” from infected computers.
Job location: Remote / Serbia
Responsibilities
- Collecting raw data from the threat actor environment on a daily basis
- Supervising automatic processing of this structured raw data
- Investigating and resolving data processing problems
- Fixing and improving our data processing code so it could automatically handle similar data scenarios
- Processing and indexing “snowflake” data dumps
- Assessing the security value of data in a dump file, assessing the technical format (SQL dump, structured text data), deciding how to process the data to extract the key security information, and executing the tasks of processing and indexing
Requirements
- 3+ years of experience in software engineering using Python is a must
- Experience with MongoDB, ElasticSearch, and AWS cloud services is highly desirable
- Strong problem solving capabilities and experience troubleshooting data issues within your own processes and those of your peers
- Comfortable in a work environment where urgent issues arise often, and where quickly resolving issues has immediate security value for our end customers
- General knowledge of cybersecurity (or more) and interest in working “upstream” close to the threat actors who are compromising computers/networks
- Experience in working in a professional software engineering environment that involves thorough code testing and review processes
- Excellent knowledge of English, written and spoken
Nice to Have
- Knowledge of Russian, reading and writing in a basic technical setting