Analyst IV - Threat Intel

What you'll be doing...:

• Performing day-to-day operations as a trusted advisor on advanced threat hunt for team
• Leading "hunt missions" using threat intelligence, data from multiple sources and results of brainstorming sessions to discover evidence of threats, insider misconduct, or anomalous behavior
• Utilizing advanced threat hunting techniques and tools to detect, analyze, and respond to anomalous activities. This includes identifying threat actor groups and characterizing suspicious behaviors as well as being able to identify traits, C2, and develop network and host-based IOCs or IOAs.
• Finding evidence of threats or suspicious behavior, and leveraging data to improve controls and processes; this will require a blend of investigative, analytical, security, and technical skills to be successful.
• Evaluating and making recommendations on security tools and technologies needed to analyze potential threats to determine impact, scope, and recovery.
• Ensuring gaps in detections are socialized with Cyber Security stakeholders; this includes identifying dependencies, recommendations, and collaborating to mitigate threats.
• Reviewing outcomes of incident lessons learned, root cause analysis, and on-demand compliance audits to ensure repeatable and sustainable processes are established, followed or adjusted when necessary.
• Acting as subject matter expert in internal and external audit reviews. This includes producing and presenting artifacts and executive summaries to support the overall mission of the TMC.
• Participating in Purple Team, Threat Hunt, and tabletop exercises.
• Working closely with key cross-functional stakeholders to develop and utilize proactive and mitigating measures to prevent, detect and respond to potential threats to Verizon on prem and cloud environments.
• Presenting executive-level operational read-outs, metrics, and case reviews that accurately capture the effectiveness of the threat hunt team. This includes leveraging internal data, threat trends, and operational metrics to clearly communicate the Verizon landscape to senior executives, to include the Chief Information Security Officer.
• Developing and executing long-term and short-term strategic goals and ensuring proper updates are socialized to appropriate stakeholders.
• Mentoring and advising team members by educating them on advanced techniques to help drive the operational and strategic growth of the organization.
• Promoting an environment of collaboration and individual accountability when it comes to problem-solving, decision-making, and process improvements.

What we're looking for...:

This threat hunter role will work in the TMC's fast paced collaborative environment and is required to be adaptable, utilize both strategic and tactical techniques, and think creatively to effectively navigate the evolving threat landscape. This individual will take the initiative to identify and neutralize threats through proactive hunting and detection, improve incident response and mitigation strategies, and ensure continuous operations to safeguard Verizon from current and future cyber threats. The position will support threat hunting, digital forensics, and incident responder duties.

You'll need to have:

• Bachelor's degree or four or more years of work experience
• Six or more years of experience in cybersecurity, with a focus on threat hunting, cloud security (AWS, GCP, Azure, OCI), and incident response

Even better if you have one or more of the following:

• Demonstrated experience as a key member of a security operations team (SOC, Incident Response, Threat Intel, Malware Analysis, IDS/IPS Analysis, etc.)
• Comprehensive knowledge utilizing system, cloud, application and network logs.
• High-level understanding of operating systems: Windows, Unix/Linux, and OSX operating systems in support of identifying security incidents.
• Proficient knowledge of the cyber threat landscape including types of adversaries, campaigns, and the motivations that drive them.
• Experience working with analysis techniques, identifying indicators of compromise, threat hunting, and identification of intrusions and potential incidents.
• Fundamental understanding of tactics, technologies, and procedures related to cyber crime, malware, botnets, hacktivism, social engineering, APT or insider threat
• Knowledgeable with regular expressions, YARA and SIGMA rules, AQL and KQL type and at least one common scripting language (PERL, Python, Powershell)
• Knowledge on query structures like strong understanding of cyber based adversarial frameworks including MITRE ATT&CK and Lockheed Martin's Cyber Kill Chain.
• Certifications like: Network+, Security+, CISSP, CISM, GCIH, GCFA, GCFE, GREM and/or cloud-specific certifications (ex: AWS Certified Security - Specialty, Microsoft Certified: Azure Security Engineer Associate, Google Cloud Certified Professional Cloud Security Engineer)

Skills

Incident Response, Threat Hunting, Threat Intel, Threat Intelligence