Secureworks (NASDAQ: SCWX) is a global cybersecurity leader that secures human progress with Secureworks® Taegis™, a SaaS-based, open XDR platform built on 20+ years of real-world threat intelligence and research, improving customers’ ability to detect advanced threats, streamline and collaborate on investigations, and automate the right actions.
We enjoy competitive compensation and benefits packages, and reward and recognize our employees for exceptional results. A constant focus on continued learning and growth keeps our team members engaged and excited about “what’s next.” We offer flexible work options when available, and emphasize the importance of work-life balance. We know that when our people are rewarded, recognized, and rejuvenated, we win as a team.
Role Overview
The Incident Response Senior Advisor works with consultants and customers in the growing area of cybersecurity incident response management. This role supports a team of consultants delivering reactive services focused on management of active MDR incident response engagements, as well as delivering response actions to customers in a consultant role on an as-needed bases. Responding to incidents includes helping customers manage technical and non-technical aspects of managing response to complex, large-scale incidents; conducting detailed technical analysis to identify the scope and magnitude security incident activity, develop timelines of activity, develop remediation recommendations and plans.
The Incident Response Senior Advisor works with incident responders, security analysts, and customers in the growing area of cybersecurity incident response management. This role operates as a key member of an incident response team delivering emergency services focused on management of active Managed Extended Detection and Response (MXDR) incident response engagements. Responding to incidents includes helping customers manage technical and non-technical aspects of managing response to complex, large-scale incidents; conducting detailed technical analysis to identify the scope and magnitude security incident activity, develop timelines of activity, develop remediation recommendations, mitigation plans, and incident reporting.
Role Responsibilities
-
Team member will operate as initial escalation path for incident response escalations originating from Secureworks MXDR service
-
Review security-related events and assess their risk and validity based on available telemetry from network, endpoint, and global threat intelligence information to provide customers with concise, detailed, and well-written incident reports, root causes identification, and remediation recommendations
-
Perform technical analysis and develop technical conclusions based on analysis of evidence
-
Serve as subject matter expert in incident response and digital forensics
-
Perform complex incident response technical analysis and develop technical conclusions based on analysis of evidence; review analysis and conclusions of other consultants
-
Document findings and develop incident response remediation recommendations to present both orally and in written reports for customers
-
Develop playbooks based on customer needs
-
Use the Secureworks platform to proactively hunt for and investigate activity within the customer environment
Requirements
-
6+ years of advanced security and forensic experience with two or more major operating systems: Microsoft: 8, 8.1, 7, Vista, XP, Server, 2012, 2008, 2003, 2000; OS X; Unix; Solaris and Linux variants; iOS; Android
-
Familiarity with Jupyter notebooks and python development for forensic analysis
-
Strong security analysis skills of networking data and traffic
-
Understanding of threat hunting methodologies using both endpoint and network-based telemetry
-
Strong experience with multiple forensic tools (such as Encase, FTK, X-Ways, F-Response, Volatility, Blacklight, MacQuisition, Recon)
-
Operational experience with security tools (firewalls, IDS, IPS, SIEMs, proxies, VPNs)
-
Understanding of vulnerabilities and tools used to discover/analyse/exploit vulnerabilities (Nessus, Nmap, Metasploit)
-
Ability to utilize Markdown markup language to document analysis findings and provide results to customer in an organized manner
-
Strong technical communication skills (oral and written) including experience briefing executive management and desire to work with customers to solve complex security issues, including at times in crisis situations
-
Understanding of at least one Compliance Framework Experience: ISO 27001/2, FISMA, PCI, HITRUST, NIST 800-series, CoBIT
-
Ability to have consultative conversations with the customer focused on service delivery concepts, processes, and technical investigations
Preferred Skills
-
8+ years of information security experience.
-
1+ years of Python development with Jupyter notebook experience
-
Bachelor's degree, preferably in computer science, information systems, information assurance; or equivalent work experience
-
Technical or professional certifications such as GCFA, GCTD, GCFR, Microsoft 365/Azure, and AWS
Secureworks is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment. All employment decisions at Secureworks are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate. Secureworks will not tolerate discrimination or harassment based on any of these characteristics.
#Radancy
Top Skills
What We Do
Dell Technologies is a unique family of businesses that provides the essential infrastructure for organizations to build their digital future, transform IT and protect their most important asset, information.
