Senior Security Engineer - CSIRT

 Do the best work of your career as a champion for small and mid-size businesses.

BILL is a leader in financial automation software for small and midsize businesses (SMBs). As a champion of SMBs, we are dedicated to automating the future of finance so businesses can thrive. Hundreds of thousands of businesses trust BILL solutions to manage financial workflows, including payables, receivables, and spend and expense management. With BILL, businesses are connected to a network of millions of members, so they can pay or get paid faster. Through our automated solutions, we help SMBs simplify and control their finances, so they can confidently manage their businesses, and succeed on their terms. 

BILL is a trusted partner of leading U.S. financial institutions, accounting firms, and accounting software providers. We have operations in San Jose, CA, Draper, UT, Houston, TX and Sydney, AUS and are continuing to expand into other geographic locations. If you’re looking for a place that helps you do the best work of your career, look no further than BILL.

This position can be based at any one of the following  locations:  San Jose,  Draper, Houston.   We support a  hybrid work environment with on-site and remote work days.

Make your impact within a rapidly growing Fintech Company

• Continuously and proactively monitor network and host-based security logs, SIEM to flag any abnormalities/malicious activity and prevent them from causing any damage
• Work with SOC vendor to provide Tier-2 support, monitor, triage and remediation assistance
• Research emerging threats and detection capabilities; develop recommendations to enhance existing monitoring solutions or adopt new ones.
• Analyze logs and security alerts to detect malicious activity and threats in the environment
• Using the MITRE Attack framework, develop, enhance, test, and implement threat detection rules
• Consolidate and conduct a comprehensive analysis of threat intelligence data obtained from classified, proprietary, and open-source resources to provide indications and warnings of impending attacks against unclassified and classified networks.
• Conduct/facilitate forensic examination of electronic devices in the furtherance of investigations and company legal requests
• Coordinate and drive resolution on a diverse range of incidents. Analyze root causes, trends of the alerts/incidents.
• Respond in a timely manner (within documented SLA) to security incidents.
• Maintain records of security monitoring and incident response activities, utilizing case management and ticketing technologies.
• Collaborate well with cross-functional partner teams, such as Legal and Engineering for large-scale efficient response.
• Able to participate in an on-call rotation.
• Regularly maintain and update existing systems, update firewall policies, patch vulnerabilities. Reduce false positives and generate more accurate security alerts by development and continuous improvement of rules to correlate security events.
• Build playbooks to support and improve security incident response processes
• Recommend changes to standard operating procedures (SOP) and other similar documentation. 
• Participate in automation, project work, detection engineering, and process improvements.

We’d love to chat if you have:

• 4+ years of professional work experience in the information security field, with emphasis on security operations, incident management,Threat Detection.
• SOC automation development and cloud operations experience
• Thorough knowledge of SIEM, SOAR and EDR technologies.
• Experience with EnCase, FTK, X-Ways, SANS SIFT, Splunk, Volatility, WireShark, TCPDump, and open source forensic tools
• Understanding of Incident Response Life Cycle and Digital Forensics.
• Experience with Mac, Linux and Windows operating systems
• Ability to handle high pressure situations with key stakeholders
• Good Analytical skills, Problem solving and Interpersonal skills 
• Advanced technical writing skill and on-call experience
• Bachelor’s degree in IT/CS/related field or equivalent work experience
• Professional certification such as GCIH/GCFA/CEH/CHFI is highly preferred

Let’s talk about benefits

• 100% paid employee health, dental, and vision plans (choose HMO, PPO, or HDHP)
• HSA & FSA accounts 
• Life Insurance, Long & Short-term disability coverage
• Employee Assistance Program (EAP)
• 11+ Observed holidays and wellness days and flexible time off 
• Employee Stock Purchase Program with employee discounts
• Wellness & Fitness initiatives
• Employee recognition and referral programs
• And much more