Principal Threat Analyst | Remote, USA

Optiv • Overland Park, KS

3d • Remote

About The Position

Optiv is seeking a Principal Threat Analyst to join Optiv Security’s 24x7x365 Security Operations Center as a member of the Advanced Fusion Center (AFC) team. The AFC provides security operations expertise and managed services to a growing client base across industry verticals. Its custom-tailored security solutions are delivered through Client Engagement, Engineering Operations, and Detection and Response Operations teams, which work together to help clients reach their security maturity goals.

The Principal Threat Analyst conducts deep analysis of client investigations using customer-provided data sources, audit, and monitoring tools in government and enterprise environments. The role works closely with Technology Engineers, Architects, and Threat Analysts to support customers. This position is fully remote and may be hired anywhere in the continental United States. Because the team provides 24/7 support, the role requires shift flexibility, including rotation between day, mid, and night shifts. Travel to meet client needs is approximately 10%.

Requirements

• 7–10 years of related work experience.
• At least 6 years of operational experience assessing, reviewing, and remediating infrastructure vulnerabilities, CVEs, and risks.
• Knowledge of third-party software vulnerabilities and the security threat landscape, especially network and server threats.
• Knowledge of cybersecurity threats and risks, vendor computing environments, basic systems, and network technologies.
• Experience with and understanding of CVEs and CVSS scores.
• Knowledge of compensating controls and mitigating factors.
• Knowledge of information security frameworks, guidelines, and standard methodologies.
• Knowledge of Windows and/or Linux operating systems.
• Knowledge and understanding of cybersecurity controls, logging, and monitoring tools.
• Ability to interact effectively with personnel at all levels.
• Excellent verbal and written communication skills.
• Strong problem-solving and analytical skills.
• Ability to manage multiple projects using a prioritization and results-oriented approach.
• Teamwork and flexibility to support operations.
• Advanced understanding of the cyber threat landscape, adversary tactics and techniques, available security controls and telemetry, and incident response terminology, processes, and techniques.
• Experience with moderate-to-complex investigations using multiple tools, including endpoint, UEBA, public cloud, SaaS, and packet analysis.
• Experience with threat response activities and common response playbooks.
• Experience with process development and documentation.
• Extensive experience with the MITRE ATT&CK framework and associated tactics.
• Extensive alert triage and endpoint investigation experience using technologies such as EDR.
• Experience with phishing analysis and malware analysis; malware analysis does not include reverse engineering.
• Knowledge of AWS, Azure, and GCP cloud service technology.
• Knowledge of metrics and reporting using data visualization tools such as Tableau.
• Demonstrable data analytics skills and a passion for data analysis.
• Willingness to travel to meet client needs, approximately 10%.

Responsibilities

• Operate independently within a geographically dispersed team, maintain situational awareness, and keep the team informed.
• Perform security monitoring and incident response across networks using a variety of tools and techniques.
• Proactively hunt for incidents across security-relevant datasets.
• Thoroughly document incident response analysis activities.
• Review investigations by more junior analysts to ensure quality standards are met.
• Develop repeatable methods for identifying malicious activity across networks.
• Recommend enhancements to detection and protection capabilities.
• Present technical topics to technical and non-technical audiences.
• Develop and follow operational procedures to analyze, escalate, and assist with remediation of information security incidents.
• Prioritize multiple high-priority tasks and formulate responses and recommendations for customers and team members in a fast-paced environment.
• Assist other security teams and collaborate on major engineering and architecture initiatives.
• Continually develop technical skills and advance team capabilities.
• Engage with and mentor other team members.
• Apply knowledge of attack methodologies, malware analysis, malicious toolkits, and their manifestations in security technologies.
• Conduct advanced proactive threat hunting and use case design for insider threat, operations, threat detection, and response.
• Review defensive and detective controls to reduce client attack surface.
• Investigate security events across endpoint, UEBA, public cloud, SaaS, and packet-analysis tools.
• Recommend security use case designs and tuning of security detection platforms to improve detection accuracy.
• Perform threat response activities, such as host quarantine and other common response playbook actions.
• Apply threat intelligence to improve detection and response capabilities.
• Conduct alert triage, endpoint and phishing investigations, and malware analysis (excluding reverse engineering).
• Support basic fraud and insider-threat investigations.
• Use data analytics and visualization tools for metrics and reporting.

Benefits

• Employee Resource Groups.
• Work/life balance.
• Professional training resources.
• Creative problem-solving and the opportunity to tackle unique, complex projects.
• Volunteer opportunities through Optiv Chips In.
• Technology and resources necessary to work productively remotely/from home where applicable.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed