Detection Engineer/Endpoint Security Engineer
Mitsogo Inc3 days ago
Chennai, IndiaMid Level / Senior
Responsibilities
- Author, tune, maintain, retire, and replace endpoint threat detection rules mapped to MITRE ATT&CK.
- Translate adversary techniques into detection logic using telemetry from Windows and macOS agents and drivers.
- Build benign adversary emulations to reproduce technique telemetry without shipping offensive capability or live C2.
- Analyze telemetry gaps and provide implementable requests to driver and agent teams.
- Contribute to endpoint event data-model decisions and identify detections that are not implementable with current sensors.
- Triage alert noise, identify false-positive candidates, and draft exclusion, whitelist, and tuning logic.
- Maintain the goodware corpus and prevalence gating used in release-gate regression runs.
- Benchmark competitor capabilities and maintain ATT&CK coverage documentation.
Requirements
- 2–4 years of experience in detection engineering, threat hunting, SOC L2/L3, or endpoint security product engineering.
- Knowledge of Windows internals including processes, threads, handles, services, the registry, scheduled tasks, PE files, Authenticode signing, Security event logs, logon types, and common LOLBins.
- Experience with Sysmon or equivalent EDR telemetry and detection-rule tuning.
- Fluency with MITRE ATT&CK and the ability to turn techniques into detection logic and test cases.
- PowerShell and Python scripting skills sufficient to build internal tooling.
- Experience with rule authoring, static PE analysis, and similarity hashing using imphash, ssdeep, and TLSH.
- Experience with malware triage and unpacking.
- Exposure to Microsoft's AV ecosystem, including MVI, ELAM, AMSI, and ETW Threat Intelligence, or to independent lab testing such as AV-Comparatives and AV-TEST.
- Exposure to macOS endpoint telemetry through the Endpoint Security framework.
- Experience using GitLab and Jira in a product engineering workflow.
About Mitsogo Inc
Mitsogo Inc builds Hexnode, a unified endpoint management platform for IT and security teams to manage and secure laptops, mobiles, and other devices. The SaaS product supports Apple, Android, Windows, macOS, Linux, and tvOS, with features spanning device, application, identity, and threat management for businesses globally. Founded in 2013 and headquartered in San Francisco, the privately held company serves customers in 100+ countries.