Principal Threat Analyst

This is a fully remote position, open to applicants in Kansas.

📋 Description

• Function autonomously within a geographically diverse team while maintaining situational awareness and ensuring the team remains informed.

• Conduct security monitoring and incident response tasks across networks utilizing a variety of tools and techniques.

• Identify incidents through proactive hunting within security-relevant data sets.

• Document activities related to incident response analysis.

• Assess junior analysts’ investigations to ensure adherence to quality standards.

• Create repeatable methodologies for detecting malicious activities across networks.

• Suggest improvements to detection and protection capabilities.

• Present technical subjects to both technical and non-technical audiences.

• Develop and adhere to operational processes for analyzing, escalating, and assisting with the remediation of information security incidents.

• Manage multiple high-priority tasks and devise responses and recommendations for customers and team members.

• Support other security teams.

• Enhance technical skills and elevate team capabilities.

• Engage with and mentor team members.

• Collaborate on significant engineering and architecture projects.

• Utilize knowledge of attack methodologies, malware analysis, malicious toolkits, and their manifestations in security technologies.

• Perform advanced proactive threat hunting.

• Implement advanced adversary emulation concepts.

• Design sophisticated use cases for insider threats, operational threat detection, and response.

• Evaluate defensive and detective controls to minimize the client’s attack surface.

⛳️ Requirements

• 7-10 years of relevant work experience is required.

• 6+ years of operational experience in assessing, reviewing, and remediating infrastructure vulnerabilities, CVEs, and risks.

• Understanding of third-party software vulnerabilities and the security threat landscape, particularly concerning network and server threats.

• Familiarity with cybersecurity threats and risks, vendor computing environments, and basic systems and network technologies.

• Experience with CVEs and CVSS scores.

• Knowledge of compensating controls and mitigating factors.

• Awareness of Information Security frameworks, guidelines, and standard methodologies.

• Proficiency in Windows and/or Linux operating systems.

• Familiarity with cybersecurity controls, logging, and monitoring tools.

• Capable of interacting effectively with personnel at all levels.

• Exceptional verbal and written communication skills.

• Strong problem-solving and analytical abilities.

• Ability to manage multiple projects by prioritizing and adopting a results-oriented approach.

• Flexibility to support operations as needed.

• Advanced understanding of adversary tactics and techniques, security controls, telemetry data, and incident response terminology, processes, and techniques.

• Experience conducting moderate to complex investigations using endpoint, UEBA, public cloud, SaaS, and packet analysis tools.

• Recommendations for security use case design to enhance threat detection.

• Involvement in threat response activities, including host quarantining and standard response playbook tasks.

• Proactive threat hunting utilizing various client tools.

• Development and documentation of processes.

• Application of threat intelligence to enhance detection and response capabilities.

• Extensive experience with the MITRE ATT&CK framework and its associated tactics.

• Significant alert triage and endpoint investigations using EDR technologies.

• Analysis of phishing incidents.

• Malware analysis (excluding reverse engineering).

• Expertise in the MITRE ATT&CK framework and comprehension of common attack tactics employed by threat actors.

• Ability to recommend tuning of security detection platforms and use cases.

• Knowledge of AWS, Azure, and GCP cloud service technologies.

• Basic skills in fraud and insider threat investigations.

• Familiarity with metrics and reporting using data visualization tools such as Tableau.

• Demonstrable data analytics capabilities.

• Passion for data analysis.

• Willingness to travel as necessary to meet client needs, approximately 10% of the time.

🏝️ Benefits

• Work/life balance.

• Access to professional training resources.

• Opportunities for creative problem-solving and engagement in unique, complex projects.

• Volunteer opportunities through “Optiv Chips In.”

• The necessary technology and flexibility to work productively from home or remotely (where applicable).