Threat Hunting & Detection Content Analyst
Description
Title: Consultant Location: Bangalore/Hyderabad/Chennai/Pune/Mumbai Shift: Afternoon Shift Experience: 5+ years of cyber security operations experience, 2+ years hands-on experience in threat hunting and security detection content engineering
The Threat Hunting & Detection Content Analyst is responsible for the following activities:
Threat Hunting . Research tactics, techniques and procedures (TTPs) to plan threat hunting execution . Participate in the planning and execution of our threat hunting program . Perform research and development augmenting our capabilities . Perform proactive threat identification & hunting activities and follow up based on the result . Ad-hoc Incident support Security Detection Content Engineering . Participate in the planning and execution of our security detection content engineering program . Translate intelligence and incident response report into actionable detection capabilities . Develop new and novel detection mechanisms, behavioral detection use cases, IOCs, etc. . Perform research and development augmenting our capabilities. . Identify new and emerging trends in threat actors' TTPs . Ad-hoc Incident support
This role can be located in any CGI office in India or the Philippines. Threat Hunting & Detection Content Service Management . Assist in producing operational report for effectiveness of the detection content & threat hunting service . Plan and deliver initiatives to streamline the services operations . Assist to manage the service operations . Establish and improve workflow, procedure, guideline for the services and automate the processes to optimize the teams' operations
Automation and Integration . Initiate automation idea and deliver with Automation team to improve the operation efficiency and the quality of the detection content and threat hunting services. . Plan and deliver integration between different technologies platforms to improve our detection content and threat hunting services.
Other Responsibilities . Participate in innovation projects including the building, deployment and evaluation of new technologies . Participate in technology evaluation in collaboration with other stakeholders. . Provide advanced threat awareness and education to members of the team The candidate should be able to demonstrate a thorough understanding of cyber security especially in threat hunting, security detection content engineering, digital forensic, incident response and threat intelligence areas. The candidate must possess an indepth knowledge of modern threats, threat actors' TTPs, threat hunting and detection content tools/platforms and methodologies.
Education and Experience: . 5+ years of cyber security operations experience and at least 2+ years hands-on experience in threat hunting and security detection content engineering. . Bachelor's degree in computer engineering, Computer Science, Information Technology, Cyber Security, or related field; advanced degree preferred.
Qualifications: . Proficient in using threat hunting tools such as Endpoint Detection and Response (EDR) & Log Analysis Platforms (SIEM) . General Knowledge of security tools such as TIP, NGFW, Sandbox, SASE, SIEM, EDR, WAF etc . Experience with scripting and programming languages (e.g., Python, Bash, etc.) for automation and analysis . Knowledge of various standard detection content format (Sigma, YARA, Snort Rule etc) . Knowledge of cyber security principles, practices, technologies, and standards . Strong knowledge of current threat, vulnerabilities and threat actors TTPs . Strong understanding of cybersecurity frameworks (e.g., MITRE ATT&CK, Cyber Kill Chain) . Knowledge of Windows, Linux and Mac Operating system . Strong knowledge of threat hunting, detection content and preferably also Incident Response, digital forensics and Threat Intelligence . Proficient in spoken and written English
Certifications: . eCTHP, GCFA, GREM, OSCP, CISSP or other reputable, technical and defensive/offensive focused certification are preferred
Skills:
English, Process Design, Python, Threat Risk Assessment, Workflow