Threat Analyst 2

What You Will Do (Duties and Responsibilities)

• Review security-related events via cases and assess their risk and validity based on available telemetry from network, endpoint, and global threat intelligence information to provide customers with concise, detailed, and well-written incident reports, root causes identification, and remediation recommendations

• Provide customers with understandable context around their security environment and threats

• Interface with customers to address their issues, concerns, and questions, and drive to satisfactory closure any issues that impact the service and its value

• Work with customer and internal Sophos incident response teams to resolve ongoing intrusions, malware outbreaks, and other security incidents

• Use the Sophos platform to proactivity hunt for and investigate activity within the customer environment

• Review security-related events via investigations and assess their risk and validity based on available telemetry from network, endpoint, and global threat intelligence information to provide customers with concise, detailed, and well-written incident reports, root causes identification, and remediation recommendations

• Provide customers with understandable context around their security environment and threats

• Interface with customers to address their issues, concerns, and questions, and drive to satisfactory closure any issues that impact the service and its value

• Work with customer and internal Sophos incident response teams to resolve ongoing intrusions, malware outbreaks, and other security incidents

What You Will Bring (Experience and Qualifications)

• At least 3 years of experience working in a SOC environment or computer security team in an IT environment

• Endpoint and network security experience required; IDS, IPS, EDR, ATP, Malware defenses and monitoring experience

• Experience with threat hunting

• Experience administering and supporting Windows and Unix bases Operating Systems, including both workstations and servers

• Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc

• Fundamental understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc

• Strong understanding of Windows event log analysis

• Experience with basic Python scripts (reading and understanding)

• Working knowledge of incident response procedures

• Excellent troubleshooting and analytical thinking skills

• Must be able to thrive within a team environment as well as on an individual basis

• Customer service-oriented with strong documentation and communication skills

• Passion for all things information technology and information security

• Natural curiosity and ability to learn new skills quickly

• Ability to think outside the box

• Innovative mindset and driven to contribute to a team providing a best-in-class cybersecurity service

• Bachelors in Information Technology, Computer Science or a related field; or relevant commensurate work experience

• Willingness to participate in rotating weekend and holiday coverage (our MDR service is 24x7x365)

• Knowledge of MITRE ATT&CK framework

• Experience with enterprise information security data management - SIEM experience

• Experience with CQL query construction

• Experience with OS Query Programming and scripting skills - knowledge of PowerShell

• Relevant Cyber Security certifications (CompTIA, SANS)