Comfort using version control systems (Git) and collaborative development practices.
Willingness to operate carefully in an environment where changes affect large-scale infrastructure.
A strong sense of responsibility, ownership, and attention to detail.
Roles & Responsibilities:
Sustaining & Operations: Help maintain, monitor, and troubleshoot deployed security monitoring agents (e.g., osquery) across a large and varied fleet of Linux systems.
Framework Support: Assist in maintaining and improving the framework that supports these agents, including CI/CD pipelines (GitHub Actions or equivalent), automated testing, and release processes.
Ongoing Operational Support: Provide dependable day-to-day operational support to help ensure availability, performance, and stability of the monitoring infrastructure.
Packaging & Distribution: Build, maintain, and support distribution packages (e.g., .deb, .rpm) across multiple Linux distributions.
Automation & Scripting: Write and maintain shell scripts and Python tooling to automate deployment, configuration, monitoring, and remediation tasks.
Reliability & Change Management: Follow careful change management practices, keeping in mind that actions in this role can have wide-reaching impact across the company's systems.
Collaboration: Work alongside CSIRT analysts, infrastructure teams, and other stakeholders to support monitoring coverage and continuous improvement.
Preferred Qualifications:
Exposure to osquery or similar endpoint security/telemetry agents.
Some background in security operations or SOC/CSIRT environments.
Experience supporting Linux systems at scale.
Practical knowledge of at least one major cloud service provider platform (by decreasing order of preference: AWS, Azure, GCP)
Awareness of containerization and orchestration (Docker, Kubernetes).
Basic understanding of monitoring/observability platforms and log pipelines.
What Defines Success in This Role
Reliable, stable operation of security monitoring agents across the fleet.
Well-tested, dependable contributions to the supporting framework and pipelines.
Proactively flagging and helping resolve operational issues.
A consistent record of safe, careful changes in a large-scale environment.
Adaptability to the ever-changing landscape of security tools/techniques