Consultant - Enterprise Incident Management | Remote, USA

View full description

Requirements:

• Prior experience performing Incident Response, including experience in Containment and Isolation, Forensics, Root Cause Analysis, and/or Elimination and Remediation to enterprise-level organizations.
• Proficiency with commercial and open-source security tools required (EnCase, FTK, XWays, Splunk, ELK, EZ Tools etc.)
• Familiarity with many different network architectures, network services, system types, network devices, development platforms and software suites required (Linux, Windows, Cisco, Oracle, Active Directory, JBoss, .NET, etc.) required.
• Familiarity with Endpoint Detection and Response (EDR) products, such as SentinelOne, Carbon Black, CrowdStrike, etc.
• Demonstrated ability to create comprehensive incident reports required.
• Demonstrated effective time management skills, ability to balance multiple projects simultaneously and the ability to take on large and complex projects with little or no supervision required.

Responsibilities:

• Perform digital investigations including: Zero Day Exploitation, Business Email Compromise, Unauthorized Access, Sensitive Data Exposure, Insider Threat, Malware Analysis, and Threat Hunting.
• Combine multiple separate findings to identify complex attacks and incidents
• Manually collect relevant data sources during an incident.
• Identify, describe and report threat vectors and forensic artifacts
• Contribute to the development and continuous improvement of the EIM practice through various team and industry contributions.