Active Security Enterprises jobs

Role and Responsibilities

• Hunt on TTPs, t hreat s / r isks and/or vulnerabilities aligned to the MITRE Att3ck framework based on both internal and external intelligence data .

• Proactively identify possible threats, risks or security control gaps to the enterprise and produce detection & mitigation recommendations to reduce the overall Attack Surface for the bank .

• Participate in proactive ASR operations within the enterprise and cloud using threat intelligence, analysis of anomalous log data and results of brainstorming sessions to detect and mitigate threats

• Develop advanced methodologies to identify threat adversary tools, techniques , and procedures .

• Produce metrics and develop dashboards to identify potential threats, suspicious/anomalous activity, malware, etc.

• Drive the tuning of detection infrastructure with technology teams to identify emerging threats .

• Document best practices to enhance hunting playbooks, procedures, and courses of action

• This role is considered a subject matter expert for hunting via host-based and network-based analysis and will work cross-functionally with their peers on other teams such as intelligence, SOC analysts, IR team, and security engineering.

• Proactively review internal processes and activities and identify opportunities for improvement .

• Influence behavior to reduce risk and foster a strong information security management culture throughout the enterprise .

• Remain informed of emerging issues, industry trends and/or relevant changes to the security landscape .
  

Qualifications

• Bachelor's Degree/ Master's degree (preferred) in an IT /Cyber -related field or equivalent experience .

• At least 7 + years of cyber security experience;

• 3 + years of experience in a malware reverse engineering , threat hunting , DFIR , threat detection or threat intelligence position (preferred) .

• Expert knowledge of log management, security analytics and event management platform mechanics .

• Experienced with SIEM, SOAR , EDR, cloud-native tools , and other cyber security tool s ets .

• Advanced knowledge of Endpoint & Identity/IAM architectures , operations , and investigations ; cloud hunting experience is preferred.

• Displayed proficiency in Security Incident & Event Management and Endpoint Detection & Response tooling; Splunk ES, CrowdStrike, Logscale, Defender for Endpoint (MDE) / MS Sentinel , Wiz Defend . Optional/Good to have: Netskope, Akamai, AppOmni , Qualys & Symantec DLP experience .

• Deep understanding of coding /scripting and APIs in support of investigations, localized automation, and integrations; Python experience a plus .

• Must be able to identify and generate detection logic to enhance the enterprises defensibility .

• Hands on experience with writing and implementing complex analytics queries, threat visualization dashboards, a nd large data volume analysis (e.g. Splunk, Logscale, KQL, syslog, etc.) .

• Strong working knowledge of security-relevant data, including network protocols, ports and common services, such as TCP/IP network protocols and application layer protocols (e.g. HTTP/S, DNS, FTP, SMTP, Active Directory , etc.)

• Extensive knowledge of Windows , Mac and Linux-based endpoints including operating systems, services, file systems, and agents .

• Excellent written and oral communication skills .

• Organizational and self-directing skills .

• Ability to initiate, coordinate and prioritize r esponsibilities and follow through on tasks to completion .

• Ability to work independently on a variety of assignments with minimal supervision .
  

Certifications :

Note: Ideal /Preferred candidate would have obtained at least 2 of the certification s from this list.

• General Cyber certs: CISSP, C ISM , CASP+, CEH , GSEC, GCIH, GCIA, GMON .

• Endpoint / Forensic certs: GREM, GCFE , GCFA, CHFI, CCFE, CFCE , EnCE .

• Cloud certs: CCSP, CCSK, GCP, AWS, Cloud+, MS Azure Associate or Solutions Architect Expert .

• Pen - testing certs: GPEN, CPENT, eCPPT, OSCP, OSCE .

• Coding/Scripting/SIEM certs: SPLUNK and/or KQL Certification , Scripting/Python certificate.