-
Develop and enhance enterprise data security detection capabilities, including but not limited to DLP, sensitive data identification, data encryption/decryption, and data masking.
-
Continuously validate and optimize existing data security rules, models, and detection strategies to improve coverage and accuracy.
-
Participate in data security incident identification, response, investigation, and forensics.
-
Build and maintain data asset maps; use graph-based techniques to trace data flows and identify risks of sensitive data exfiltration.
-
Use enterprise data platforms to perform risk analytics, anomaly detection, and data-focused threat modeling.
-
Build and improve host-based detection capabilities, including malware analysis, intrusion detection, threat modeling, and host behavior baseline modeling across office and production environments.
-
Continuously refine host security policies and detection models to improve detection performance and reduce false positives.
-
Handle host security alerts and incident response end-to-end.
-
Enhance endpoint data collection pipelines to improve data completeness, integrity, and real-time coverage.
-
Detect and analyze APT attacks and attempted intrusions across multi-cloud and hybrid environments; support endpoint security architecture improvements.
-
Bachelor’s degree or above in Information Security, Network Security, Computer Science, or related fields; 3–5+ years of experience in data security or host security.
-
Strong understanding of security attack/defense techniques and enterprise security system design.
-
Hands-on experience with data security or endpoint security products (e.g., DLP, EDR, UEBA, sensitive data identification).
-
Proficiency in macOS and Linux systems; experience with enterprise endpoint protection solutions.
-
Familiarity with big data analytics platforms such as Flink, Spark, Hive, Elasticsearch, and graph analysis technologies.
-
Strong analytical thinking, communication skills, and a solid understanding of compliance and legal obligations in security operations.
-
Experience designing endpoint data protection or host agent solutions.
-
Experience detecting or analyzing APT attacks in enterprise environments.
-
Experience in data lineage analysis, graph-based security analytics, or sensitive data flow tracing.
-
Hands-on experience with security data models, detection rule engines, or in-house security product development.
-
Prior experience building or operating host/data security systems within an enterprise security team.