Tetragon Threat Detection Engineer

About the role

Cilium Tetragon is a Kubernetes-aware security tool that uses eBPF to monitor system behavior such as process execution, system calls, network and file access events. As a Tetragon Threat Detection Engineer, you will create and maintain runtime security policies based on threat intelligence, vulnerability disclosures and your own research, acting as either mitigation for known vulnerabilities or protection against unknown ones.

Key responsibilities

• Develop and maintain Tetragon runtime security policies so customers can see suspicious activity and stay protected against emerging threats.
• Help design frameworks and architectures that let customers easily consume policies and understand their security posture.
• Monitor CVEs and threat intelligence to build new policies.
• Work with software engineers at Isovalent and Cisco to improve Tetragon security policies.
• Support and deploy policies in production with solution architects and customers.
• Publish content and give talks on your work.

Required profile

• 3+ years of experience in threat and/or vulnerability research.
• 3+ years of experience developing security detections at scale across many environments.
• 3+ years of experience on Linux system security (capabilities, LSMs, etc.).
• Good written and verbal communication skills.

Required skills

• Linux system security (capabilities, LSMs)
• Preferred: eBPF and its security applications
• Preferred: cloud-native ecosystem (containers, Kubernetes) and Linux cgroups, namespaces