Incident Response Analyst

6 days ago

Apply Now

Receive Emails with Similar Jobs

Thrive

WebsiteLinkedInAll Job Openings

NextGen Technology Services

Managed IT Services • Complete Outsourced IT Services • Hosted Cloud Services • Help Desk Support • Onsite Engineering

201 - 500

Description

• Work within Thrive’s security standards and best practices and recommend future enhancements • Keep up to date with current security threats and trends to ensure that playbooks are relevant and effective • Actively investigate the latest security vulnerabilities, advisories, incidents, and TTPs (tactics, techniques, and procedures) and work with the Security Engineering team to recommend use cases • Proactive monitoring, threat hunting, and response of known and/or emerging threats • Analyze data from our SOC, SIEM and EDR platforms and determine if further analysis is needed • Carry out Thrive’s information security strategy both internally and externally for 400+ clients • Monitor and evaluate security incidents to identify opportunities for improving playbooks • Conduct regular reviews of playbooks to ensure they are current and effective • Participate in tabletop exercises and drills to test and validate playbooks • Lead incident response and threat hunting efforts for confirmed High Priority security incidents and follow through until resolution • Investigate intrusion attempts, differentiate false positives from true intrusion attempts, and perform in-depth analysis of exploits • Process investigation requests from SOC Analysts who perform security event monitoring using Security Information and Event Management (SIEM) from multiple sources, including but not limited to, events from network and host-based intrusion detection/prevention systems, network infrastructure logs, systems logs, applications, and databases

Requirements

• Demonstrates comprehension of best security practices • Has advanced knowledge of the following systems and technologies: SIEM (Security Information and Event Management) • TCP/IP, computer networking, routing, and switching • IDS/IPS, penetration and vulnerability testing • Firewall and intrusion detection/prevention protocols • Windows, UNIX, and Linux operating systems • Network protocols and packet analysis tools • EDR, Anti-virus, and anti-malware • Content filtering • Email and web gateway. Malware, Network, or System Analysis • Professional experience in an Incident Response Role • Ability to collaborate and communicate security issues to clients, peers, and management • Strong analytical and problem-solving skills • Adaptability and resilience in rapidly evolving situations • Ability to be a part of an on-call rotation, occasionally working nights, and weekends to support High Priority Security Incidents • Technical proficiency in networking, operating systems, and security technologies • Familiarity with security tools like SIEM, IDS/IPS, EDR, and forensic analysis tools • Understanding of incident response procedures and methodologies • Understanding of frameworks such as MITRE ATT&CK and the Cyber Kill chain • Familiarity with TCP/IP network protocols, application layer protocols (e.g., HTTP, SMTP, DNS, etc.) • Experience in responding to and investigating cloud, system, or network intrusions • Excellent Written and Verbal Communication Skills • Expertise in forensics, malware analysis, and network intrusion response