Security Research Engineer

Job description

Meet the Team Creating leading threat intelligence is the focus of the Cisco Talos Security Intelligence and Research Group (Talos). Talos is comprised of leading threat researchers supported by sophisticated systems. Talos researchers create and modify threat intelligence for Cisco products to protect customers from both known and emerging threats. Talos provides the content and logic for Cisco Secure Firewall, Cisco Secure Email, Cisco Secure Email Threat Defense, Cisco Secure Web, Cisco Umbrella, ClamAV, Snort, and SpamCop. Your Impact The Research Escalation Engineer works as part of the Talos Escalations group and is responsible for handling efficacy critical issues for our intrusion prevention, anti-virus, email, and web security suites. You will support a wide range of solutions, including Cisco Secure Firewall, Cisco Secure Endpoint, Cisco Secure Email, Cisco Secure Malware Analytics, Cisco Umbrella, Talos Sender Domain/IP Reputation, and the Talos Reputation Service. As a Talos Research Engineer, you will: Triage internal and external escalations related to security efficacy, coverage, scoring, listing, and reputation determinations made by our security systems. Provide third-tier response to intrusion prevention, anti-virus, email, and web security issues called out from customer support and other customer-facing teams. Manage ticketing queues and respond to alerts generated by monitoring systems. Contribute to the establishment of procedures and standard processes for internal and external use. Collaborate closely with tier-four detection content and engineering teams. Minimum Qualifications (Provide up to five (5) bullet points – Solid base knowledge of networking, transport, and application layer protocols (e.g., IP, TCP, UDP, HTTP). Good communication and teamwork skills, with sound judgment regarding the handling of proprietary information. Extremely strong analytical and problem-solving skills. Customer-focused attitude with a strong commitment to quality and thoroughness. Strong written and verbal communication skills. Strong technical aptitude with a passion for continuous learning. Preferred Qualifications (Provide up to five (5) bullet points: Knowledge of intrusion and anti-virus detection techniques. Knowledge of spam, malware, and phishing techniques. UNIX experience and familiarity with diagnostic tools (e.g., dig, traceroute, whois). Strong email knowledge, including administration, blocklists, RFCs, and the ability to interpret email headers and SMTP traffic. Solid base knowledge of application layer protocols (e.g., SMTP, POP, IMAP, SIP, SSL). Experience with Python, shell scripting, regular expressions, and SQL. Why Cisco? At Cisco, we’re revolutionizing how data and infrastructure connect and protect organizations in the AI era – and beyond. We’ve been innovating fearlessly for 40 years to create solutions that power how humans and technology work together across the physical and digital worlds. These solutions provide customers with unparalleled security, visibility, and insights across the entire digital footprint. Fueled by the depth and breadth of our technology, we experiment and create meaningful solutions. Add to that our worldwide network of doers and experts, and you’ll see that the opportunities to grow and build are limitless. We work as a team, collaborating with empathy to make really big things happen on a global scale. Because our solutions are everywhere, our impact is everywhere. We are Cisco, and our power starts with you.