Jr. Threat Operations Analyst

Internova Travel Group•Remote,

7d•$45,247 - $74,233

About The Position

The Jr. Analyst, Threat Operations supports the daily operation of Internova's end user facing security controls and contributes to the identification, analysis, and disposition of threats affecting the enterprise. The role combines hands on operational work, including end user support, SOC escalation handling, and email and endpoint protection administration, with analytical work covering event triage, phishing and business email compromise analysis, threat intelligence and brand protection monitoring of Internova's external footprint, and validation of vulnerabilities and reported threats. The Internova Travel Group Information Security Team is committed to providing outstanding support to our team members to ensure continued growth opportunities, and access to extraordinary tools and technology. Our corporate culture encourages leaders at all levels to think independently, make decisions autonomously, and inspire passion in all aspects of our work.

Requirements

Bachelor's degree in software engineering, computer science, cybersecurity, computer information systems, a related field, or equivalent practical experience.
0 to two years of professional experience, inclusive of internships, co-ops, or research appointments in security operations, threat analysis, penetration testing, or application security.
Ability to analyze security events and logs methodically, form a hypothesis, and reach a defensible conclusion about whether activity is malicious, suspicious, or benign.
Working knowledge of common attack techniques against web applications, APIs, identity systems, and email, including authentication, authorization, injection, and business logic flaws.
Understanding of indicators of compromise and how they are collected, enriched, and applied to detection and blocking.
Exposure to at least one major cloud platform (AWS, Azure, or GCP) and to core cloud security concepts such as identity, logging, and network segmentation.
Familiarity with industry standard encryption technologies and cybersecurity technical controls.
Excellent written and verbal communication skills, including the ability to explain technical risk to non technical stakeholders and to write findings a reader can act on.
Ability to apply organizational policies and procedures to everyday operational decisions.
Ability to travel as needed.

Responsibilities

Address end user support request for information security issues and SOC escalation requests.
Day to day administration of end user facing security technologies (Mimecast, Microsoft 365 ATP, Cisco Umbrella, Cisco AMP)
Monitor and report on security events across multiple internal platforms, performing first line triage and escalating with sufficient documentation for downstream analysis.
Support phishing and business email compromise defense, including analysis of user reported messages, tuning of ATP and Mimecast rule sets, and extraction of indicators for blocking and detection use.
Track threat activity relevant to the travel and hospitality sector using Recorded Future and other sources, including business email compromise, credential stuffing, booking and payment fraud, and supplier impersonation, and summarize the impact for Internova.
Day to day use of Recorded Future for threat intelligence and brand reputation monitoring, including alert triage, watch list and query maintenance, indicator enrichment, and routing of actionable intelligence to the appropriate owner.
Investigate brand and domain impersonation, typosquatting, exposed services, and credential exposure affecting Internova and its brands, coordinating takedown and blocking action and reporting findings to enterprise security leadership.
Supplement platform reporting with independent open source intelligence collection, structuring findings so they can be acted on rather than simply forwarded.
Validate and triage vulnerability scanner and security tooling output, separating exploitable findings from false positives and tracking remediation to closure with application and infrastructure owners.
Assist information security team members with project tasks, troubleshooting, and administration responsibilities, and recommend tooling and process enhancements to senior information security staff.