Incident Response Analyst

The Incident Response (IR) Analyst is responsible for monitoring security alerts and events of a critical nature to identify, contain and remediate security incidents across various services impacting the company’s customers. The IR Analysts support the SOC team through the management and administration of security and monitoring tools.

• Thoroughly investigate and triage suspicious/malicious activity and escalate or closes events, as applicable utilizing the SIEM and other relevant 3rd party (approved) tools.
• Perform Malware analysis through sandboxes, OSINT, and other resources.
• Develop operational procedures to implement and continually improve the incident response processes.
• Monitor security alerts within the tech stack, and investigate any potential security incidents.
• Monitors incoming event queues for potential security incidents according to established operational procedures.
• Analyze the alerts received to classify and assess the impact, managing high priority incidents, including communication to the business, facilitating root cause analysis and resolution.
• Perform cyber security investigations as part of the incident analysis.
• Ability to summarize and communicate technical data for non-technical audiences.
• Coordinate with other departments the remediation tasks to be performed and escalate unresolved incidents.
• Responsible for researching, performing risk analysis, and security audits.
• Provide technical and incident response support.
• Identify and investigate potential computer and network intrusions.
• Perform post-mortem analysis to identify root causes and design controls or measures to prevent future incidents.
• Identify, interpret, and report security vulnerabilities on systems and networks.
• Write comprehensive investigation reports capturing investigation details and root cause analysis aligned knowledge of modern Tactics, Techniques, and Procedures (TTPs) for internal/customer purposes.
• Establish and maintain communication during Incident Response, written and/or via phone.
• Perform research on emerging threat sources/vulnerabilities.
• Develop protection strategies.
• Initiate and aid facilitation of Incident call bridge with the appropriate members (internal/customer resources). This includes summarizing activity, providing next steps or recommendations.
• Create or collaborate content production for security awareness (both internal and external) including for Trapp Technology – ArmorPoint social media platforms.
• Participates in Trapp Technology - ArmorPoint internal meetings and required trainings.
• Ability to effectively communicate with all levels of an organization.
• Maintains a professional image and demonstrates an understanding of and follows all Trapp Technology – ArmorPoint Policies and Procedures.
• Between incidents, independent research and self-study to stay up-to-date on new technologies, security trends, and the overall threat landscape.
• Other duties as assigned.

• High School Diploma or GED equivalent, required
• Security +, CISSP, CEH, and/or ECIH Certification, preferred
• 3+ years of experience in a SOC or similar role
• Demonstrated experience and understanding of cyber risks and threats related to cyber attacks
• Functional knowledge of MITRE ATT&CK framework and other cybersecurity methodologies
• Strong research ability, critical thinking, and reasoning skills
• Experience with malware analysis through sandboxes, OSINT, and other resources
• Ability to communicate with all levels of an organization
• Ability to follow detailed procedures and policies.
• Ability to compose grammatically correct, concise, and accurate notes
• Possess good troubleshooting skills and be able to isolate and fix problems quickly
• Exceptional organization and time management skills.
• Excellent written and verbal communication skills.
• Provides strong customer service to internal and external customers.
• Ability to manage multiple tasks and deadlines in a fast-paced environment.