{"title": "Security Engineer Investigator, Account Threats", "level": "", "location": "Washington, DC", "description": "The Account Threats team is dedicated to protecting the users of Meta\u2019s family of applications (e.g. Facebook, Instagram, WhatsApp, Oculus) from the worst kinds of account security issues we experience. You will have the opportunity to work on some of the most challenging, complicated, and high-visibility security risks the company is facing through an account security lens. The impact of your work will be substantial, as outcomes could affect the billions of people who use our products.\n\nWe are seeking an experienced security engineer to proactively detect and analyze root causes of account security abuses, reverse engineer novel malware or other malicious software, investigate complex threats to our business and our users, advance investigative methods, conduct data-driven decision making, and use innovative approaches to protect people from harm. The candidate must have a strong cybersecurity or cyber threat intelligence background and know how to apply it to proactively hunt for threats, be able to use code to automate investigative actions, and be proficient in scripting languages, such as PHP or Python.\n\nThe ideal candidate will be an innovative self-starter, who is motivated by our mission, is results-driven, a strategic thinker, and will be able to extract, assimilate, and correlate a wide variety of data in order to surface and disrupt account security abuses.", "salary": "US$143,000/year to US$208,000/year + bonus + equity + benefits", "key_qualifications": "5+ years work experience in a cyber security, security investigations, or cyber threat intelligence investigations role.\nExperience with queries to analyze and interpret large datasets to advance investigations, quantify trends or support findings.\nExperience investigating and acting on high-impact threats such as account compromise, account creation abuse, business compromise, or malware analysis.\nExpertise in reverse engineering and knowledge of Windows or Android reverse engineering tools such as IDAPro, JEB, or Ghidra is required. Along with understanding of machine code for at least one architecture (x86/64, ARM/AArch64)\nExpertise in reverse engineering and familiarity with Windows or Android reverse engineering tools (e.g. IDAPro, JEB, or Ghidra), to include familiarity with machine code in at least one of the architectures (x86/64, ARM/AArch64).\nProficiency in static and dynamic analysis of malicious software to understand behaviors and intent of the malicious software. Experience should include leveraging results to create malware detection rules (e.g. Yara) and hunting for malware.\nExperience working with Python, PHP, or similar scripting languages.\nExperience thinking critically and qualifying assessments with solid communications skills in a cross-functional setting to influence decision makers across all levels of technical background.\nExperience identifying effective strategies to prevent or disrupt abuse at scale. Consult on the design of countermeasures to affect those strategies.", "preferred_qualifications": "Experience working with a team spanning multiple locations/time zones.\nExperience in detecting and mitigating account abuse for a Web-based service, to include experience with authentication attacks, account generation abuse, bot detection, evasion detection, and/or browser fingerprint analysis.\n3+ years of red or purple teaming exposure.\nDeep technical and data analysis experience to analyze custom protocols to understand and expose adversarial behaviors.\nExperience with sizing abuses / threats to a Web-based service.\nExperience understanding tactics, techniques, and procedures (TTPs) and actor intent, including extracting this from malware.\nExperience in scoping, communicating, and leveraging cyber threat intelligence to proactively detect, measure, or prevent abuse.\nExperiencing tracking highest priority malware campaigns.\nExpertise with multiple malware file formats.\nExperience using SQL for data analytics and processing large data sets.\nDemonstrated interest in understanding the intersection of global security risks, and how they apply to social media.\nDemonstrated interest in exploring how global security risks intersect with social media.\nExperience with open source investigation techniques and familiarity with a variety of internet research tools.\nBS/MS or equivalent experience in Computer Science, Information Systems, Intelligence Studies, Cybersecurity or related field.\nExperience working across or contributing to the broader security community (public research, blogging, presentations, open source contributions, etc.)", "responsibilities": "Proactively hunt for threats and undetected abuse by leveraging internal data, open source intelligence, and third-party private intelligence.\nInvestigate complex account security abuses to understand in granular detail how abuse is occurring. Identify and implement appropriate detection or prevention strategies to mitigate harm both in the current case and from similar forward-looking abuse.\nUnderstand the application of tactics, techniques, and procedures, as well as tooling, that actors use across various attack surfaces.\nReverse engineer malware and other potentially malicious software interacting with Meta platforms or users to derive behaviors indicative of abusive interactions with our platforms.\nDesign signatures (e.g. file, network) to detect, hunt, and prevent malware compromise.\nLead technical investigations from start-to-finish, to include effectively communicating actionable results, analytic judgments, and mitigations to different audience types across cross-functional settings.\nSelf-directed identification of trends in adversary behavior, and proactive surfacing of risks that may represent previously unidentified or novel vectors for harm. Deeply understand how abuse manifests and clearly explain emerging threats and trends, with an emphasis on security understanding.\nAnalyze and interpret complex, high volume, and high dimensionality data from varying sources to advance investigations, quantify trends, or support findings.\nTake a leadership role in suggesting, prototyping, and teaching novel investigative techniques.\nPartner with other cross-functional teams to identify, influence, and implement holistic solutions to surfacing and responding to emerging threats.\nManage multiple projects at once while effectively prioritizing time, based on team priorities.\nAutomate the everyday tasks and actions conducted during investigations and team processes.", "company": "meta"}