Threat Analyst

ThreatLocker•Orlando, FL

About The Position

ThreatLocker® is a leader in endpoint protection technologies, providing enterprise-level cybersecurity tools to improve the security of servers and endpoints. The ThreatLocker® platform with Application Allowlisting, Ringfencing™, Storage Control, Elevation Control, Endpoint Network Control, Configuration Management, and Operational Alert solutions are leading the cybersecurity market toward a more secure approach of blocking the exploits of application vulnerabilities. Job Summary: The Threat Analyst is responsible for identifying, investigating, and responding to cyber threats, vulnerabilities, and security incidents across the organization’s systems and networks. This role focuses on proactive monitoring and quick response to security events to protect the organization's data and critical infrastructure. The ideal candidate has strong technical skills in threat detection, security monitoring, and incident response. In addition to core responsibilities assigned to the department, this role will be responsible for the aggregation, processing, and dissemination of threat intelligence as it relates to a rapidly evolving threat landscape. The Threat Analyst will monitor various threat intelligence feeds (open and closed source) for emerging threats and malware variants. The role will have a high level of interaction with the ThreatLocker malware analysis network to detonate, analyze, and extract telemetry to evaluate against existing product detections and controls at which time visibility gaps will be identified and reported to the designated Threat Specialist for additional analysis and content creation.

Requirements

3 years of experience in Information Technology with 1 year of specialized work in any of the following IT domains:
Active Directory
Application Development
Network Administration
Information Security
Education in Information Technology or a comparable degree can offset 2 years of required experience for high achieving individuals
Experience with virtual machines on VirtualBox, Workstation Pro (Type 2 hypervisor)
Foundational knowledge of Active Directory infrastructure
Proficient in PowerShell and Python
Strong understanding of foundational Windows OS components
Windows Firewall
Windows Event Logs
Windows file structure
PowerShell
Strong understanding of networking and security principles
RFC 1918, DNS, well-known ports, TCP/IP
CIA triad and its relevance to Information Security
AAA Framework
Familiar with MITRE ATT&CK framework
Cybersecurity technologies and their applications
SIEM
IDS/IPS
NGFW
SOAR
EDR
Excellent analytical and problem-solving skills
Ability to communicate effectively
Self-starting mentality
Critical thinking
Ability to work in a high-pressure environment
Ability to collaborate and work effectively in a team setting
Strong time management skills with an ability to meet time sensitive deadlines
Confidence in conveying professional opinions about product functionality and roadmap
Strong familiarity with SIEM tools, EDR tools, and IDS/IPS systems.
Knowledge of network security technologies and protocols (TCP/IP, DNS, VPNs, firewalls, etc.).
Proficiency in scripting languages such as Python, PowerShell, or Bash.
Proficiency in custom SNORT, SIGMA, and YARA rule creation.
Understanding of malware behavior, attack vectors, and vulnerability exploitation techniques.
Excellent analytical and problem-solving abilities.
Ability to work under pressure and manage multiple detection initiatives simultaneously.
Strong written and verbal communication skills, with an ability to present technical concepts clearly.
Detail-oriented with the ability to quickly assess security issues and provide appropriate remediation actions.

Nice To Haves

Bare-metal (type 1) hypervisor experience (ESXi, HyperV) ++
Relevant certifications
Network+
Security+
CySa+
GSEC, GCIA.
GIAC Certified Intrusion Analyst (GCIA)
GIAC Security Essentials Certification (GSEC)
Certified Information Systems Security Professional (CISSP)
Certified Ethical Hacker (CEH)
OffSec Certified Professional (OSCP)
CompTIA Certs
Security +
Network +
Pentest +
CASP+

Responsibilities

Monitor security tools and systems (SIEM, IDS/IPS, EDR, etc.) for suspicious activity or breaches.
Analyze security alerts and data to identify potential threats, vulnerabilities, and compromises.
Build and refine detection capabilities using security tools, threat intelligence, and machine learning models.
Lead and participate in the response to security incidents (investigating, containing, eradicating, and recovering from threats).
Collaborate with cross-functional teams to develop incident handling processes and ensure timely remediation.
Create detailed post-incident reports, including root cause analysis and recommendations for improvements.
Develop automated tools and scripts to enhance security detection capabilities and streamline threat detection workflows.
Maintain and enhance detection tools, including writing custom SNORT, SIGMA, and YARA rules, and updating rulesets in accordance with new threats.
Conduct forensic analysis and threat hunting to identify malicious activity.
Review logs from various systems (e.g., firewalls, servers, network devices) to uncover unauthorized activities.
Research and stay current on emerging threats, vulnerabilities, and cyber-attack techniques.
Contribute to the enhancement of security monitoring tools, processes, and playbooks.
Develop automated scripts and tools to improve detection and response efficiency.
Work closely with DevOps, Network, and Security Engineering teams to ensure secure architectures and systems.
Leverage internal and external threat intelligence sources to stay informed about the latest security trends and threats.
Share insights with internal stakeholders to ensure proactive measures are in place.
Ensure security processes and procedures align with regulatory requirements and industry best practices (e.g., NIST, CIS, ISO 27001).
Assist in the preparation of audit reports and security assessments.