About Osto
Osto is a protection-first, all-in-one cybersecurity platform that makes startups enterprise-ready in minutes - securing cloud, apps, APIs, devices, and data with real enforcement.
Role Overview
Osto needs a Threat Detection Engineering Lead to pioneer threat detection and security research for its cybersecurity platform, covering endpoint, network, cloud, advanced web/API detections and shift-left features amid rapid scaling. Own security research and detection engineering, focusing on WAAP threats like OWASP Top 10, API abuse, and bot attacks alongside core cyber domains. Build/tune detections in SIEM for WAAP telemetry from Osto's WAF/DLP/ZTNA; AI-first for predictive web threats
What You'll Do
- Conduct threat research: Analyze TTPs (MITRE ATT&CK), hunt emerging threats in cyber domains; analyze WAAP-specific attacks (SQLi, XSS, API exploits); publish internal intel reports. handbook.
- Develop detections: Create SIEM rule s(logs from WAAP, endpoints, cloud) , UEBA models, ML baselines for anomalies in logs/telemetry; integrate with Osto stack.
- WAAP focus: Integrate detections for web traffic (bots, RCE), API rate limiting, shadow API discovery; pentest validation via sandboxing.
- Optimize pipeline: Test, deploy, tune rules to cut false positives; automate response playbooks via SOAR.
- Lead team: Mentor juniors, collaborate with VAPT/QA/devs; drive threat modeling sessions.
- AI-first edge: Leverage RAG/ML for predictive threat sims and auto-detection generation.
What We're Looking For
- 7+ years in detection engineering or security research, with hands-on WAAP/WAF experience.
- Expertise in SIEM platforms like Splunk or ELK for rule creation, tuning, and telemetry analysis.
- Proficiency in Python/Go scripting, MITRE ATT&CK mapping, and UEBA/ML for anomaly detection.
- Strong threat hunting skills, including web/API vulnerabilities (OWASP Top 10, bots, API abuse).
- Experience with cloud security (Azure/AWS/K8s) and WAAP tools (e.g., Cloudflare WAF, Imperva equivalents).
- Proven leadership: team mentoring, cross-functional collaboration with VAPT/QA/dev teams.
Nice-to-Have Requirements
- AI/ML integration for detections (RAG-powered threat simulation, auto-rule generation).
- Compliance knowledge (SOC2/ISO 27001 reporting for cybersecurity platforms).
