Barracuda

Lead an engineering team developing and testing detections, running threat hunts and attack simulations, and improving global SOC operations and response. | Requires 6+ years in security operations, detection engineering, and offensive security, team leadership, Python and SQL, penetration-testing tools, cloud platforms, and SIEM expertise. | Location: Remote, USA Come join our passionate team! Barracuda is a leading cybersecurity company providing complete protection against complex threats. Our platform protects email, data, applications, and networks with innovative solutions, and a managed XDR service, to strengthen cyber resilience. Hundreds of thousands of IT professionals and managed service providers worldwide trust us to protect and support them with solutions that are easy to buy, deploy, and use. We know a diverse workforce adds to our collective value and strength as an organization.  Barracuda Networks is proud to be an Equal Opportunity Employer, committed to equal employment opportunity and equitable compensation regardless of race, gender, religion, sex, sexual orientation, national origin, or disability. Envision Yourself at Barracuda Barracuda is seeking an Offensive Security Manager to lead a team of cybersecurity engineers focused on threat detection and attack stimulation across a wide range of technologies, including SaaS, endpoint, network, and cloud platforms. In this role, you will play a critical part in driving detection innovation, engineering processes, and attack and defend lifecycle for Barracuda XDR. This is a unique opportunity to blend security operations, data engineering, detection engineering, offensive security and leadership in a global 24x7 Security Operations Center (SOC). You will work with over 50 different data sources and lead efforts aligned with the MITRE ATT&CK framework, while fostering collaboration between red, purple, green and blue teams to advance threat detection and response along with ensuring overall improvement and enhancement of Barracuda Security Operations Center. What You’ll Be Working On Proactive Engineering & Detection Development • Lead and mentor a team of cybersecurity Engineers • Develop, test and tune detection rules for multiple attack vectors across cloud, network, and endpoint telemetry. • Design and maintain CI/CD pipelines to version and deploy detection rules. • Implement and manage the full lifecycle of SIEM detection rules. • Foster collaboration between red and purple teams to drive offensive and defensive innovation. • Create and execute sprint projects using Agile methodologies to improve SOC maturity and R&D efforts. • Implement proactive threat hunting initiatives across customer networks. • Guide and monitor your team through complex security incidents such as ransomware. Attack Operations & Adversary Simulation • Lead adversary simulation exercises and exploit research initiatives • Design and execute detection testing scenarios and breach simulations • Conduct tabletop exercises and kill chain rehearsals • Develop and manage a open-source red teaming repository for attacks and stimulations • Develop threat modeling frameworks and campaign replay scenarios • Conduct and manage live “attack and defend” exercises to test detection and response readiness Threat Hunting & Proactive Detection • Implement proactive threat hunting initiatives across customer networks • Lead efforts in identifying emerging TTPs and zero-day discovery • Oversee malware analysis and hunt campaigns • Drive trend analysis and adversary profiling initiatives • Manage threat publications such as blogs, webinars, and podcasts. Strategic Planning & Operations • Drive strategic planning, goal setting, and roadmap execution. • Ensure key SOC metrics, SLAs, and detection performance standards are met. • Coordinate and maintain a global 24x7x365 on-call schedule. • Provide regular reporting and weekly metrics related to Level 5 operations. • Serve as a key point of escalation for critical security incidents. • Lead implementation of new rules based on evolving vulnerabilities and adversary TTPs. Innovation and R&D • Lead R&D for emerging use cases, tools, and integration efforts. • Guide to the evaluation and adoption of new technologies aligned with future-facing cyber defense. • R&D around use of AI and automation for offensive security. What You Bring To The Role • 6+ years in security operations, detection engineering and offensive security • 2-3 years in leadership experience managing high-performing cybersecurity teams. • 3–4 years of hands-on experience with Python and SQL. • Experience with Kali and other pentesting/hacking tools • Developed and managed lab environments for attack and defend exercises • Bachelor’s or master's degree in Cybersecurity, Information Security, or related field. • Strong understanding of cloud platforms (AWS, Azure, GCP). • Experience with SIEMs like Elastic and Databricks, including advanced detection implementation. • Familiarity with Windows, Unix, and Linux systems. • Experience with threat intelligence platforms (e.g., Anomali, Cybersixgill). • Strong verbal and written communication skills. • Demonstrated ability to work across global time zones (U.S. East, India and Ireland teams). • Strong project management, problem-solving, and decision-making skills. • Ability to lead during high-pressure cybersecurity incidents and guide team response. What You’ll Get From Us A team where you can voice your opinion, make an impact, and where you and your experience are valued. Internal mobility – there are opportunities for cross training and the ability to attain your next career step within Barracuda. • Equity, in the form of non-qualifying options • High-quality health benefits • Retirement Plan with employer match • Career-growth opportunities • Flexible Time Off and Paid Time Off benefits • Volunteer opportunities Job ID: 27-0467

Lead incident response engagements, manage SentinelOne XDR platform, perform host-based forensics, develop detection rules, and engage with clients during security incidents. | 5+ years incident response or security operations experience, GIAC certification, expertise with SentinelOne and Microsoft 365 security, and MSSP or consulting background preferred. | Location: Remote Come join our passionate team! Barracuda is a leading cybersecurity company providing complete protection against complex threats. Our platform protects email, data, applications, and networks with innovative solutions, and a managed XDR service, to strengthen cyber resilience. Hundreds of thousands of IT professionals and managed service providers worldwide trust us to protect and support them with solutions that are easy to buy, deploy, and use. We know a diverse workforce adds to our collective value and strength as an organization. Barracuda Networks is proud to be an Equal Opportunity Employer, committed to equal employment opportunity and equitable compensation regardless of race, gender, religion, sex, sexual orientation, national origin, or disability. Envision Yourself At Barracuda We are seeking a Senior Endpoint Security & IR Engineer to join our incident response team. You will lead management of our SentinelOne XDR platform, complex investigations across multiple client environments, drive rapid containment of active threats, and serve as a trusted advisor to clients during their most critical security events. This role combines deep technical expertise with client-facing communication skills in a fast-paced, multi-tenant MSSP environment. You will work closely with our Cyber Concierge, Threat Analysts and Automation teams to continuously improve our response capabilities and protect our clients from sophisticated adversaries. What You’ll Be Working On • Expert knowledge and experience in SentinelOne – Key Requirement • Lead end-to-end incident response engagements across diverse client environments, from initial triage through remediation and lessons learned • Perform host-based forensics using Binalyze AIR for remote evidence acquisition, triage, and analysis at scale • Design custom detection rules within SentinelOne and fine tune protection policies. • Proven experience in windows, mac and linux environments • Investigate alerts and threats detected by SentinelOne, including Deep Visibility hunting, threat timeline reconstruction, and MITRE ATT&CK mapping • Analyze Microsoft 365 security incidents including business email compromise, OAuth abuse, mailbox rule manipulation, and Azure AD/Entra ID attacks • Conduct log analysis and threat hunting in Elastic to identify indicators of compromise, lateral movement, and data exfiltration • Leverage Databricks for large-scale log analytics, anomaly detection, and threat hunting across aggregated client telemetry • Document findings in clear, executive-ready incident reports tailored to both technical and non-technical stakeholders • Participate in a 24/7 on-call rotation Automation & Detection Engineering • Develop and maintain Python scripts for evidence collection, log parsing, IOC enrichment, and automated response actions • Build and optimize automated response workflows in Tines to accelerate containment and MTTR • Create and tune detection rules in Elastic and SentinelOne based on investigative findings and emerging threat intelligence • Integrate tooling across the security stack to streamline IR workflows and reduce manual effort. Client Engagement & Service Delivery • Serve as the primary IR point of contact for client stakeholders during active incidents • Conduct client-facing incident briefings, root cause analysis presentations, and post-incident reviews • Deliver actionable remediation guidance tailored to each client's environment and risk tolerance • Maintain SLA commitments for incident acknowledgment, updates, and resolution • Contribute to client security posture assessments and IR readiness recommendations. What You Bring To The Role • Minimum of bachelor’s degree in computer science and 5+ years of hands-on experience in incident response, digital forensics, or security operations • MSSP, MDR, or consulting experience is strongly preferred. Demonstrated ability to manage multiple client engagements simultaneously. • Proven track record investigating real-world incidents including ransomware, BEC Attacks, lateral movement, data exfiltration etc. • Experience working in multi-tenant environments with diverse security maturity levels. • GIAC certification required; one or more of the following: • GCIH (GIAC Certified Incident Handler) • GCFA (GIAC Certified Forensic Analyst) • GCFE (GIAC Certified Forensic Examiner) • GNFA (GIAC Network Forensic Analyst) • Equivalent certifications considered: OSCP, eCIR, eCDFP, EnCE, SC-200, AZ-500 Required Technical Skills In Core Platforms • DFIR - Binalyze AIR - remote acquisition, triage, timeline analysis and artifact collection. • EDR - SentinelOne threat investigations, Deep Visibility, detection engineering, policy configuration • Microsoft 365 / Defender - BEC investigation, UAL analysis, Safe Links/Attachments, Entra ID etc. • Analytics - Databricks - large-scale log analysis, SQL/Python notebooks, threat hunting at scale • Automation - workflow automation, playbook development, API integrations and continuous monitoring. Preferred Qualifications • Experience with additional EDR platforms (CrowdStrike, Microsoft Defender for Endpoint) • Advanced knowledge of macOS and Linux forensics • Familiarity with threat intelligence platforms (MISP, Recorded Future, Virus Total Enterprise) • Experience with Velociraptor, KAPE, or Volatility for advanced forensic collection and investigations. • Prior experience in IR teams or serving as an IR practice SME What You’ll Get From Us A team where you can voice your opinion, make an impact, and where you and your experience are valued. Internal mobility – there are opportunities for cross training and the ability to attain your next career step within Barracuda. • Equity, in the form of non-qualifying options • High-quality health benefits • Retirement Plan with employer match • Career-growth opportunities • Flexible Time Off and Paid Time Off benefits • Volunteer opportunities The anticipated salary range for this role is $110,000 to $135,000. Actual compensation offered will be dependent upon the individual's skills, experience, and qualifications as they directly relate to the requirements of the position, the budget for the position, and applicable employment laws. At Barracuda, we believe in fair and equitable compensation practices that reflect both market realities and the unique circumstances of each geographical location. We recognize that cost-of-living disparities, market conditions, and other factors can significantly impact compensation expectations in different regions. The compensation range provided in this job description is for illustrative purposes only and may not reflect the actual compensation offers for the position in your location. Final compensation will be determined based on a variety of factors including the candidates’ qualifications and experience. Job ID: 27- 2704