Tomorrow’s health is… Tackling challenges no one else can.

Responsibilities
• Leading incident triage activities such as host analysis and retrieval, malware analysis, remote system analysis, network device log review, end-user interviews, and remediation efforts. 

• Coordinate and drive incident response efforts across the enterprise (identification, analysis, containment, eradication, and recovery), and post-mortem lessons learned. 

• Perform host-based forensic reviews of systems to determine facts relevant to incident investigations and relay that information accurately to applicable stakeholders in real-time. 

• Perform root cause analysis of security events and incidents to facilitate continuous improvement of processes and detection/prevention strategies. 

• Compile and disseminate detailed investigation reports to applicable stakeholders when required. 

Requirements

• 10+ years of relevant cyber security experience in Threat Hunting, IT Security, Incident Response, or network security with strong knowledge working in a Security Operations or Incident Response team. 

• Experience with risk management, vulnerability management, threat analysis, security auditing, security monitoring, incident response and other information security practices. 

• Strong analytical and investigation skills. 

• Excellent written and oral communication skills with the ability to effectively communicate with information technology professionals as well as senior management and auditors, assessors, and consultants. 

• High level of personal integrity, and the ability to professionally handle confidential matters and exude the appropriate level of judgment and maturity. 

• Working knowledge of root causes of malware infections and proactive mitigation. 

• Working knowledge of lateral movement, footholds, and data exfiltration techniques 

• Ability to mentor and potentially independently lead a team of Digital Forensics and Incident Response professionals. 

Preferred Technical and Professional Expertise

• One or more of the following security certifications or equivalent: GCIH (GIAC Certified Incident Handler), GCFA (GIAC Certified Forensic Analyst), GNFA (GIAC Network Forensic Analyst), CCFP (Certified Cyber Forensics Professional), and CFCE (Certified Forensic Computer Examiner) 

• Masters Computer Science or equivalent degree is preferred 

• Knowledge of the underlying logic that security alerts are built upon and apply them when analyzing raw logs and creating new dashboards and alerts. 

• Recognize complex problems, analyze situations and provide suggested and/or implemented resolution(s) 

• Experience and knowledge of packet flow, TCP/UDP traffic, firewall technologies, IDS technologies, proxy technologies, and antivirus, spam and spyware solutions. 

• Provide leadership and guidance to the team and act as a resource to the team members. 

• Experience with one or more scripting languages (e.g., PowerShell, Python, JavaScript, Perl) 

• Perform memory analysis and malware analysis 

• Experience with computer exploitation methodologies