Cyber Hunt and Respond Senior Engineer - 1st Shift/Weekend (Fri, Sat, Sun, Mon OR Sun-Thurs)

Truist Financial • Atlanta, GA

368d

About The Position

The Cyber Hunt & Respond Senior Engineer is an advanced, after-hours role within the 24/7 Cyber Fusion Center. This role has 2 core functions, proactive Threat Hunting & reactive Incident Response coverage. Hunting involves searching through large, diverse sets of internal and external data to discover previously undetected threats. This role is creative and owns the development of new hypotheses on how adversaries may be attacking the organization and will prove out the hypotheses based on our available data. Additionally, this role will work with internal groups to express the data needs to explore potential threats. This role is onsite and can be based in downtown Atlanta OR Zebulon, NC and will participate in an on-call rotation with the following shift options: 1st Shift, 7am to 4pm, Sunday to Thursday (5 X 8 Schedule) - OR - 1st Shift, 7am to 6pm, Friday, Saturday, Sunday, Monday (4 X 10 Schedule).

Requirements

• Bachelor's degree in Computer Science, Computer Engineering, Cybersecurity, or related field.
• 8 years of experience in Cybersecurity or related work.
• Knowledge of one or more cloud platforms and cloud security.
• Knowledge of general information technology (IT) and cybersecurity.
• Knowledge of computer networking concepts and protocols, and network security methodologies.
• Knowledge of network traffic analysis and packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
• Knowledge of operating systems, including Windows/Unix ports and services.
• Knowledge of modern identity and access management concepts.
• Knowledge of phishing tactics and techniques.
• Knowledge of advanced cyber threats and vulnerabilities.
• Knowledge of cyber-attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
• Knowledge of adversarial tactics, techniques, and procedures.
• Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions.
• Knowledge of incident response and handling methodologies.
• Knowledge of countermeasures to address a variety of threats.
• Knowledge around leveraging automation, ML, and/or AI.
• Knowledge of advanced threat hunting techniques.
• Knowledge of types of digital forensics data and how to recognize them.
• Knowledge of types and collection of persistent data.
• Knowledge of file system implementations (e.g., NTFS, FAT, EXT).
• Knowledge of which system files contain relevant information and where to find those system files.
• Knowledge of processes for seizing and preserving digital evidence.

Nice To Haves

• Experience working in cloud environments, namely Microsoft Azure and Amazon AWS.
• Industry certifications in general technology (e.g. Network+, AWS Certified Cloud Practitioner, Microsoft Azure Fundamentals, etc.).
• Industry certifications in cyber security, such as: Security+, CySA+, GIAC Certified Incident Handler (GCIH), GIAC Certified Forensic Examiner (GCFE), GIAC Cloud Forensics Responder (GCFR), GIAC Certified Forensic Analyst (GCFA), GIAC Network Forensic Analyst (GNFA), GIAC Reverse Engineering Malware Certification (GREM), etc.
• Experience in Cyber Breach Response, Security Operations Center (SOC), Network Operations Center (NOC), IT/Cyber Engineering, or Intelligence Community (IC).

Responsibilities

• Conduct presentations and mentor others interested or responsible for related data science, threat hunting, or incident response.
• Perform log, packet, network, endpoint, root cause analysis, containment, and eradication as part of Digital Forensics & Incident Response (DFIR).
• Develop new hypotheses on potential adversarial attacks and validate them using available data.
• Advocate for the organization's threat hunting efforts.
• Consult on a variety of technical and non-technical problems within the team and larger organization.

Benefits

• Medical, dental, vision, life insurance, disability, accidental death and dismemberment.
• Tax-preferred savings accounts.
• 401k plan.
• No less than 10 days of vacation during the first year of employment.
• 10 sick days.
• Paid holidays.
• Potential eligibility for defined benefit pension plan, restricted stock units, and/or a deferred compensation plan.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Industry: Credit Intermediation and Related Activities
• Education Level: Bachelor's degree
• Number of Employees: 5,001-10,000 employees