Threat Operations Analyst

Overview

Internova Travel Group is one of the largest travel services companies in the world with a collection of leading brands delivering high-touch, personal travel expertise to leisure and corporate clients. Internova manages leisure, business and franchise firms through a portfolio of distinctive divisions. Internova represents more than 100,000 travel advisors in over 6,000 company-owned and affiliated locations predominantly in the United States, Canada and the United Kingdom, with a presence in more than 80 countries. Click here for more information about Internova Travel Group.

Responsibilities

The Threat Operations Analyst supports the daily operation of Internova's end user facing security controls and contributes to the identification, analysis, and disposition of threats affecting the enterprise. The role combines hands on operational work, including end user support, SOC escalation handling, and email and endpoint protection administration, with analytical work covering event triage, phishing and business email compromise analysis, threat intelligence and brand protection monitoring of Internova's external footprint, and validation of vulnerabilities and reported threats.

The Internova Travel Group Information Security Team is committed to providing outstanding support to our team members to ensure continued growth opportunities, and access to extraordinary tools and technology. Our corporate culture encourages leaders at all levels to think independently, make decisions autonomously, and inspire passion in all aspects of our work.

• Address end user support request for information security issues and SOC escalation requests.
• Day to day administration of end user facing security technologies (Mimecast, Microsoft 365 ATP, Cisco Umbrella, Cisco AMP)
• Monitor and report on security events across multiple internal platforms, performing first line triage and escalating with sufficient documentation for downstream analysis.
• Support phishing and business email compromise defense, including analysis of user reported messages, tuning of ATP and Mimecast rule sets, and extraction of indicators for blocking and detection use.
• Track threat activity relevant to the travel and hospitality sector using Recorded Future and other sources, including business email compromise, credential stuffing, booking and payment fraud, and supplier impersonation, and summarize the impact for Internova.
• Day to day use of Recorded Future for threat intelligence and brand reputation monitoring, including alert triage, watch list and query maintenance, indicator enrichment, and routing of actionable intelligence to the appropriate owner.
• Investigate brand and domain impersonation, typosquatting, exposed services, and credential exposure affecting Internova and its brands, coordinating takedown and blocking action and reporting findings to enterprise security leadership.
• Supplement platform reporting with independent open source intelligence collection, structuring findings so they can be acted on rather than simply forwarded.
• Validate and triage vulnerability scanner and security tooling output, separating exploitable findings from false positives and tracking remediation to closure with application and infrastructure owners.
• Assist information security team members with project tasks, troubleshooting, and administration responsibilities, and recommend tooling and process enhancements to senior information security staff.

Qualifications

• Bachelor's degree in software engineering, computer science, cybersecurity, computer information systems, a related field, or equivalent practical experience.
• 0 to two years of professional experience, inclusive of internships, co-ops, or research appointments in security operations, threat analysis, penetration testing, or application security.
• Ability to analyze security events and logs methodically, form a hypothesis, and reach a defensible conclusion about whether activity is malicious, suspicious, or benign.
• Working knowledge of common attack techniques against web applications, APIs, identity systems, and email, including authentication, authorization, injection, and business logic flaws.
• Understanding of indicators of compromise and how they are collected, enriched, and applied to detection and blocking.
• Exposure to at least one major cloud platform (AWS, Azure, or GCP) and to core cloud security concepts such as identity, logging, and network segmentation.
• Familiarity with industry standard encryption technologies and cybersecurity technical controls.
• Excellent written and verbal communication skills, including the ability to explain technical risk to non technical stakeholders and to write findings a reader can act on.
• Ability to apply organizational policies and procedures to everyday operational decisions.
• Ability to travel as needed

Pay and Benefits

Our benefit offerings include medical insurance, meal tickets, transportation allowance, paid time off, discounted employee travel options, access to LinkedIn Learning webinars and courses.

The salary range on this job posting/advertising has been developed to give applicants a range based on the local market where the candidate would be working. Many factors, such as years of experience, budget etc. are considered when determining the starting rate of pay.

This role may be eligible for an incentive, commission, bonus, or a discretionary bonus program based on the company’s financial goal achievement and individual performance.

Internova Travel Group is an Equal Opportunity Employer. We make employment decisions without regard to age, race, religion, national origin, gender, disability, veteran status, genetic information, sexual orientation and gender identity or any other protected class.

Prospective Employee Privacy Policy