DFIR Automation Engineer - Global Security Organization

The mission of TikTok's Global Security Organization is to build and earn trust by reducing risk and securing our businesses and products. We are seeking a DFIR Automation Engineer (Investigation Enablement & Threat Hunting) to focus on tooling, automation, and AI-assisted engineering to scale cross-domain investigations and drive proactive risk discovery through case-informed hunting and data mining.

Requirements

• Hands-on scripting/engineering ability for automation (Python,Go)
• Experience working with enterprise telemetry at scale (querying, correlation, pivoting) across multiple sources (internal platform audit logs, identity/cloud logs, endpoint/server telemetry, network logs, DLP)
• Ability to design workflows that produce defensible outputs: clear reasoning, evidence traceability, repeatable analysis steps, and auditable metadata
• Solid understanding of investigation/DFIR fundamentals and common investigation patterns (data access, staging, exfiltration/misuse, and scope assessment)