Princpl Threat Detect & Response Anlyst - 90386707

Amtrak

1d•$124,600 - $161,352

About The Position

The Principal Threat Detection & Response Analyst supports Amtrak’s Cyber Fusion Center and digital forensic cyber incident response team. The role is responsible for executing incident response plans and playbooks and helping detect, investigate, contain, remediate, and resolve cybersecurity incidents while reducing business risk. The analyst handles critical and high-profile incidents, examines cloud, endpoint, network, IT, and OT evidence, and supports threat hunting, malware triage, and crisis management. The position also contributes to incident-response exercises and management, coordinates with business and cross-functional stakeholders, and develops scripts, tools, playbooks, policies, and procedures to improve investigative processes and align with industry best practices. The position may be 100% remote, on-site, or hybrid. It requires off-hours work and on-call participation, with travel requirements of up to 25%.

Requirements

Bachelor’s degree in computer science, information systems, cybersecurity, or a related technical field, plus at least 7 years of relevant experience; an equivalent combination of education, training, and experience may satisfy education requirements.
Relevant experience in incident response, vulnerability management, digital forensics, network or cloud security, or penetration testing.
At least one incident-response-centric certification, such as a listed GIAC, EC-Council, eLearnSecurity, SEI, or NICCS certification.
In-depth understanding of threats, vulnerabilities, incident-response principles, and chain of custody.
Hands-on experience with forensic tools and log correlation.
Ability to think like an attacker and hunt within the security tool stack.
Ability to incorporate the MITRE ATT&CK Framework into everyday processes.
Strong technical skills with cybersecurity tools and technologies, including SIEM, EDR, threat-intelligence platforms, and malware-analysis tools.
Experience analyzing cyber threats, including malware, network traffic, and logs.
Knowledge of cyber threats, attack techniques, threat actor groups, motivations, capabilities, and TTPs.
Strong analytical and problem-solving skills, including the ability to provide actionable insights and recommendations.
Strong communication and interpersonal skills for explaining technical concepts and findings to technical and non-technical stakeholders.
Ability to work independently and collaboratively in a fast-paced environment while managing multiple tasks and priorities.
Availability for off-hours work and on-call participation.

Nice To Haves

Master’s degree in cybersecurity, information technology, digital forensics, computer science, or an equivalent technical field.
At least 10 years of experience in cybersecurity.
Basic knowledge of operational technology (OT), SCADA, HVAC, or IoT.
Two or more incident-response-centric certifications from the listed certification programs.
Preferred familiarity with operational technology, industrial control systems, or SCADA systems.
Training, certifications, or hands-on experience in advanced threat detection; hacker tools and techniques; penetration testing, exploit writing, or ethical hacking; offensive security, security operations, web application testing, or cloud security; reverse-malware engineering; digital forensics and incident response; PowerShell, JavaScript, or Python; SIEM systems, network security tools, and log analysis tools; cyber incident response; MITRE ATT&CK; threat intelligence; vulnerability management; or security incident response.

Responsibilities

Execute the cyber incident response plan and response playbooks to support timely resolution of security breaches.
Investigate and respond to incidents, including containment and remediation support, and participate in crisis management.
Perform digital forensics and incident response analysis for critical and high-profile incidents, with support from threat-hunting and malware-triage analysts.
Support Amtrak-wide incident-response engagements by examining cloud, endpoint, and network-based evidence.
Conduct IT and OT network analysis and forensics.
Identify and document attacker tools, tactics, procedures (TTPs), and indicators of compromise (IOCs) for current and future investigations.
Conduct host and network forensics, log analysis, malware triage, memory analysis, fileless malware analysis, reverse engineering, and nation-state malware investigations.
Build scripts, tools, or methodologies that enhance incident investigation processes.
Support cyber incident exercises, tabletops, and the Cyber Incident Management Response Team in collaboration with business leaders, stakeholders, and cross-functional teams.
Coordinate cyber incident response activities with Crisis Management, Emergency Management, Incident Response, Legal, and OIG teams.
Participate in tabletop exercises to identify gaps, improve skills and communication, and engage stakeholders.
Review vulnerability and penetration-testing reports and tabletop exercise results to identify potential future incidents.
Develop, refine, recommend, and maintain playbooks, policies, and procedures aligned with industry best practices.

Benefits

Health, dental, and vision insurance
401(k) with employer match
Generous paid time off
Wellness programs
Railroad retirement benefits
Paid caregiving days and backup care
Health savings account
Public Service Student Loan Forgiveness
Fertility and family-building benefits
No-cost personal health advocate
Student loan assistance
Adoption and surrogacy assistance
Medical plan opt-out credit
Tuition and education reimbursement
Paid family leave
Life insurance
Rail pass privileges
Short- and long-term disability insurance
Employee assistance program
No-cost financial advisor sessions
Commuter and flexible spending accounts
Short-term incentive bonus may be offered based on factors such as individual and company performance.