Respnsibilities

• Resource will function as a member of the Security Operation Center performing intrusion detection, prevention, and incident response.
• Must be able to operate as a member of a frontline team in security operation, monitoring and analyzing custom alerts and dashboards.
• Provides feedback in assessing new threat vectors and the effectiveness of controls.
• Leverages advanced investigative skills using best in class data correlation and network/packet analysis tools.
• Will partner with senior leaders from lines of business organizations to triage security events and report on impacting security incidents.

Requirements

• A solid foundation in networking fundamentals, with a deep understanding of TCP/IP and other core protocols!
• At least two years experience in enterprise intrusion analysis, SIEM and incident response.
• The ability to analyze logs from various security devices and web servers.
• Experience doing packet captures and interpreting them (e.g., tcpdump, Wireshark).
• Familiarity with network architecture and security infrastructure placement.
• Understanding of Windows and Unix operating systems, and command line tools.
• Knowledge of attack vectors, threat tactics, kill chain and attacker techniques is a plus.
• Experience with Cloud Incident Response is a plus (e.g., AWS, Azure)
• Ability to communicate technical and non-technical information in a clear and concise manner.
• An open mind, willingness to be challenged and strong desire to learn
• Should be flexible to work during different shift but this will primarily be during US west coast shift

Good to have

• Exposure to incident response of cloud-based and distributed infrastructures are a plus.
• Certifications from SANS, Offensive Security, ISC2 is a plus.