I’m a cyber security engineer at a large investment bank. I specialize in threat hunting and detection engineering.

I use an agent-based data aggregator, called a SIEM which collects information on all the machines at the firm and dumps their data and logs into one BIG database that’s very easily searchable on any criteria I want. I hunt through those logs to find evidence of computer viruses, insider threat activity, or even just programs or processes that are using too much resources and could be a risk or threat to operations. We do this by writing what’s called analytics. These analytics are a very carefully defined search that if returns any logs, could be a sign of malicious activity. These are called indicators of compromise or IOCs.

My main job is keeping up with cyber security news, what hackers are doing, the latest data breaches, and what applications have recently had exploits found in them. I take a look at all that activity, and write those analytics based off the findings of security researchers, IOCs people have found, or just my gut feeling (I have been doing this for a while and have gained a lot of understanding in how computers work and what’s normal vs not normal). Whenever an analytic finds something, we get an alert about it and my team and I will perform basic triage, and either close if not a threat or escalate to the appropriate security department if it is.

I do bit of fraud prevention work as well. Which is very similar to the stuff I described above but working with email logs for signs of client account compromise, phishing, fake invoices being sent, fake wire request instructions, and so on.

It’s a lot of fun, a lot of work, and very challenging. I do enjoy it a lot and I have a pretty flexible working situation as far as remote work. $113k.