Security Incident Response Engineer - DART - Block Anywhere Bookmark Share Print 653 0 3

Listing Description

Company Description

Block, Inc. is Square, Cash App, Spiral, TIDAL, TBD54566975, and our foundational teams such as Counsel, Finance, and People that provide guidance at the corporate level. These are our building blocks, united by our shared purpose of economic empowerment. We’re creating tools to help expand access to the economy.

Job Description

The Block Security team works with other teams across Block to build world-class products for both customers and employees. Our ultimate goal is to ensure that every experience with Block is simple, secure, and safe.

Block’s Detection and Response Team (DART) has four distinct teams; Security Engineering (SecEng), Monitoring & Triage, Signals and Intelligence (SIGINT), and the Computer Security Incident Response Team (CSIRT). The CSIRT aspires to deliver trusted security advisory and world-class response to security threats towards Block and its ecosystem of startups so our employees can quickly and safely build and customers can partake in the economy through secure and modern experiences.

CSIRT provides rapid and standardized security response capability to Block and it’s ecosystem of startups 24/7/365. We aim to relentlessly pursue evolving threats through proactive hunting, perform regular threat modeling, and lead cross-functional tabletops to focus on continuous learning and improvement; while providing crisis management capability with a focus of limiting the financial impact or blast radius of a security event. In order to support the company's incredible growth, we’re growing our incident response team. You will report to the Engineering Manager as part of the DART - CSIRT team. 

As a Security Incident Response Engineer you will:

• Lead the response to critical incidents, threats, vulnerabilities and bring these issues to resolution coordinating cross-functional teams.
• Demonstrate strong composure (Incident Command) while running incidents with a balance of urgency and intensity, as well as focus.
• Actively monitor, analyze and correlate activity, evaluate security events, perform research and provide in-depth incident analysis.
• Improve and automate internal capabilities for identifying, investigating, and responding to security events.
• Contribute to the creation and/or refinement of runbooks.
• Lead and participate in IR tabletop exercise to validate existing processes and procedures and to document lessons learned.
• Develop and adjust automations, scripts, and security tool configurations to drive efficiencies and enhance investigations.
• Hunt for malicious activity and provide a feedback loop to signal development/threat intelligence.
• Keep key stakeholders (both technical and non-technical) informed on details in a clear and concise manner, both written and verbally.
• Create postmortem write-ups and lead postmortem discussions.
• Be part of an on-call rotation.

Qualifications

• 5+ years of experience with incident response and forensics tools.
• Strong security knowledge in at least one of the following domains: AWS, Google Cloud Platform, Linux, Windows, macOS.
• Prior experience (1-2 years) with malware analysis, host/network-based forensics, memory forensics, and/or network traffic analysis.
• Prior experience using the MITRE ATT&CK framework to improve security incident detection and response.
• Scripting experience (i.e. Ruby, Python, shell scripting) preferred.
• Experience with open-source forensics tools like OSquery
• Empathy, patience, a desire to learn, and help your teammates grow.
• Excellent written and verbal communication skills, including the ability to communicate technical concepts clearly and effectively.
• Ability to operate independently and in a team environment in a geographically dispersed team.

Additional Information

We’re working to build a more inclusive economy where our customers have equal access to opportunity, and we strive to live by these same values in building our workplace. Block is a proud equal opportunity employer. We work hard to evaluate all employees and job applicants consistently, without regard to race, color, religion, gender, national origin, age, disability, pregnancy, gender expression or identity, sexual orientation, citizenship, or any other legally protected class. 

We believe in being fair, and are committed to an inclusive interview experience, including providing reasonable accommodations to disabled applicants throughout the recruitment process. We encourage applicants to share any needed accommodations with their recruiter, who will treat these requests as confidentially as possible.

Additionally, we consider qualified applicants with criminal histories for employment on our team, and always assess candidates on an individualized basis.

Perks

We want you to be well and thrive. Our global benefits package includes:

• Healthcare coverage
• Retirement Plans
• Employee Stock Purchase Program
• Wellness perks
• Paid parental leave
• Paid time off
• Learning and Development resources