Sr. Threat Analyst | Remote, USA

View full description

Requirements:

• Experience working in a Security Operations Center (SOC), Managed Security Service (MSS), or enterprise network environment as a point of escalation
• Data analysis using SIEM, Database tools, and Excel
• Experience troubleshooting security devices and SIEM
• IDS monitoring/analysis with tools such as Sourcefire and Snort
• Experience with SIEM platforms preferred (QRadar, LogRhythm, McAfee/Nitro, ArcSight, Splunk) a plus
• Experience with the following attacks: Web Based Attacks and the OWASP Top 10, Network Based DoS, Brute force, HTTP Based DoS, Denial of Service, Network Based / System Based Attacks
• Understand the foundations of enterprise Windows security including Active Directory, Windows security architecture and terminology, Privilege escalation techniques, Common mitigation controls and system hardening
• Experience in monitoring at least one commercial AV solution such as (but not limited to) McAfee/Intel, Symantec, Sophos, or Trend Micro
• Understanding of root causes of malware and proactive mitigation
• Familiarity with web-based exploit kits and the methods employed by web-based exploit kits
• Familiarity with concepts associated with Advanced Persistent Threats and “targeted malware”

Responsibilities:

• Documenting and reporting on potential security incidents
• Work with partners to maintain an understanding of security threats, vulnerabilities, and exploits
• Provide analysis on various security enforcement technologies
• Perform knowledge transfers, document, and train clients regarding mitigation of identified threats
• Provide ongoing recommendations to peers and customers on tuning and best practices
• Actively research current threats and attack vectors being exploited in the wild
• Actively work with analysts and perform investigations on escalations
• Ability to discuss security posture with multiple clients and make recommendations to better their holistic security approach
• Provide gap analysis for clients to better their security posture
• Maintain and develop SOPs for threat analyst team
• Develop and maintain Playbooks and runbooks
• Work with internal teams to increase efficiency and effectiveness of security analysis provided by the threat analysis team
• Training of new analysts on security and tools
• Create and maintain Content Catalog based on security essentials and the evolving threat landscape
• Provide quality assurance (QA) review of security alerts handled by Team members