COMPANY OVERVIEW

ThreatLocker® is a leader in endpoint protection technologies, providing enterprise-level cybersecurity tools to improve the security of servers and endpoints. The ThreatLocker® platform with Application Allowlisting, Ringfencing™, Storage Control, Elevation Control, Endpoint Network Control, Configuration Management, and Operational Alert solutions are leading the cybersecurity market toward a more secure approach of blocking the exploits of application vulnerabilities.

Job Summary:

The Threat Analyst is responsible for identifying, investigating, and responding to cyber threats, vulnerabilities, and security incidents across the organization’s systems and networks. This role focuses on proactive monitoring and quick response to security events to protect the organization’s data and critical infrastructure. The ideal candidate has strong technical skills in threat detection, security monitoring, and incident response.

In addition to core responsibilities assigned to the department, this role will be responsible for the aggregation, processing, and dissemination of threat intelligence as it relates to a rapidly evolving threat landscape. The Threat Analyst will monitor various threat intelligence feeds (open and closed source) for emerging threats and malware variants. The role will have a high level of interaction with the ThreatLocker malware analysis network to detonate, analyze, and extract telemetry to evaluate against existing product detections and controls at which time visibility gaps will be identified and reported to the designated Threat Specialist for additional analysis and content creation.

Key Responsibilities:

Threat Detection and Monitoring:

• Monitor security tools and systems (SIEM, IDS/IPS, EDR, etc.) for suspicious activity or breaches.
• Analyze security alerts and data to identify potential threats, vulnerabilities, and compromises.
• Build and refine detection capabilities using security tools, threat intelligence, and machine learning models.

Incident Response:

• Lead and participate in the response to security incidents (investigating, containing, eradicating, and recovering from threats).
• Collaborate with cross-functional teams to develop incident handling processes and ensure timely remediation.
• Create detailed post-incident reports, including root cause analysis and recommendations for improvements.

Security Tool Development & Automation:

• Develop automated tools and scripts to enhance security detection capabilities and streamline threat detection workflows.
• Maintain and enhance detection tools, including writing custom SNORT, SIGMA, and YARA rules, and updating rulesets in accordance with new threats.

Security Investigations:

• Conduct forensic analysis and threat hunting to identify malicious activity.
• Review logs from various systems (e.g., firewalls, servers, network devices) to uncover unauthorized activities.
• Research and stay current on emerging threats, vulnerabilities, and cyber-attack techniques.

Continuous Improvement:

• Contribute to the enhancement of security monitoring tools, processes, and playbooks.
• Develop automated scripts and tools to improve detection and response efficiency.
• Work closely with DevOps, Network, and Security Engineering teams to ensure secure architectures and systems.

Threat Intelligence:

• Leverage internal and external threat intelligence sources to stay informed about the latest security trends and threats.
• Share insights with internal stakeholders to ensure proactive measures are in place.

Compliance & Reporting:

• Ensure security processes and procedures align with regulatory requirements and industry best practices (e.g., NIST, CIS, ISO 27001).
• Assist in the preparation of audit reports and security assessments.

Key Skills & Qualifications:

Experience:

• 3 years of experience in Information Technology with 1 year of specialized work in any of the following IT domains:
  • Active Directory
  • Application Development
  • Network Administration
  • Information Security
• Education in Information Technology or a comparable degree can offset 2 years of required experience for high achieving individuals
• Experience with virtual machines on VirtualBox, Workstation Pro (Type 2 hypervisor)
• Bare-metal (type 1) hypervisor experience (ESXi, HyperV) ++
• Foundational knowledge of Active Directory infrastructure
• Proficient in PowerShell and Python

Concepts:

• Strong understanding of foundational Windows OS components
  • Windows Firewall
  • Windows Event Logs
  • Windows file structure
  • PowerShell
• Strong understanding of networking and security principles
  • RFC 1918, DNS, well-known ports, TCP/IP
  • CIA triad and its relevance to Information Security
  • AAA Framework
• Familiar with MITRE ATT&CK framework
• Cybersecurity technologies and their applications
  • SIEM
  • IDS/IPS
  • NGFW
  • SOAR
  • EDR
• Soft Skills
  • Excellent analytical and problem-solving skills
  • Ability to communicate effectively
  • Self-starting mentality
  • Critical thinking
  • Ability to work in a high-pressure environment
  • Ability to collaborate and work effectively in a team setting
  • Strong time management skills with an ability to meet time sensitive deadlines
  • Confidence in conveying professional opinions about product functionality and roadmap
• Relevant certifications
  • Network+, Security+, CySa+, GSEC, GCIA.

Technical Skills:

• Strong familiarity with SIEM tools, EDR tools, and IDS/IPS systems.
• Knowledge of network security technologies and protocols (TCP/IP, DNS, VPNs, firewalls, etc.).
• Proficiency in scripting languages such as Python, PowerShell, or Bash.
• Proficiency in custom SNORT, SIGMA, and YARA rule creation.
• Understanding of malware behavior, attack vectors, and vulnerability exploitation techniques.

Certifications (Preferred):

• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Security Essentials Certification (GSEC)
• Certified Information Systems Security Professional (CISSP)
• Certified Ethical Hacker (CEH)
• OffSec Certified Professional (OSCP)
• CompTIA Certs
• Security +
• Network +
• Pentest +
• CASP+

Soft Skills:

• Excellent analytical and problem-solving abilities.
• Ability to work under pressure and manage multiple detection initiatives simultaneously.
• Strong written and verbal communication skills, with an ability to present technical concepts clearly.
• Detail-oriented with the ability to quickly assess security issues and provide appropriate remediation actions.

WORKING CONDITIONS

The duties described below are representative of those encountered while performing the essential functions of this position. If necessary, reasonable accommodation may be requested and will be evaluated for its relationship to the essential functions that must be performed.

• Job will generally be performed in an office environment but may require travel to visit company offices and/or property locations.
• While performing duties of this job, would occasionally require to stand, walk, sit, reach with hands and arms, climb or balance, stoop or kneel, talk and hear, and use fingers and hands to feel objects and tools.
• Must occasionally lift and/or move up to 25 pounds.
• Specific vision abilities required include close vision, distance vision, depth perceptions, and the ability to adjust focus.