Senior Threat Analyst – 2nd Shift

This is a fully remote position, open to applicants in Kansas.

📋 Description

• Conduct in-depth analyses for client investigations utilizing customer-supplied data sources, auditing tools, and monitoring technologies.

• Document and report potential security incidents, including timelines of events.

• Collaborate with partners to comprehend security threats, vulnerabilities, and exploits impacting systems, networks, and assets.

• Evaluate security enforcement technologies, including SIEM, antivirus solutions, content filtering/reporting, malware prevention, firewalls, intrusion detection systems, web application firewalls, messaging security platforms, and vulnerability scanners.

• Execute knowledge transfers, document findings, and instruct clients on the mitigation of identified threats.

• Suggest tuning and best practices to colleagues and customers.

• Investigate current threats and attack vectors being exploited in the wild.

• Collaborate with analysts on escalations and conduct investigations.

• Review client security posture and propose enhancements to comprehensive security strategies.

• Conduct gap analyses to strengthen client security posture.

• Develop and maintain standard operating procedures for the threat analyst team.

• Create and update playbooks and runbooks.

• Partner with internal teams to enhance the efficiency and effectiveness of security analysis.

• Train new analysts on security practices and tools.

• Establish and manage a Content Catalog based on security essentials and the evolving threat landscape.

• Perform quality assurance reviews of security alerts addressed by team members.

• Work alongside Technology Engineers, Architects, and Threat Analysts to support customers in Optiv Security’s 24x7x365 Security Operations Center and Advanced Fusion Center.

⛳️ Requirements

• Associate's degree or equivalent experience in a Security Operations Center (SOC), Managed Security Service (MSS), or enterprise network setting as a point of escalation.

• Typically, 3+ years of professional experience in the Information Security domain.

• Strong time management, reporting, and communication skills, encompassing customer interactions and executive presentations.

• Proficiency in data analysis utilizing SIEM, database tools, and Excel.

• Experience with troubleshooting security devices and SIEM.

• Capability to create and maintain content within SIEM environments and provide recommendations for enhanced visibility.

• IDS monitoring/analysis experience with tools like Sourcefire and Snort.

• Familiarity with SIEM platforms such as QRadar, LogRhythm, McAfee/Nitro, ArcSight, or Splunk preferred.

• Understanding of direct and indirect attacks, such as SQL injection and cross-site scripting.

• Experience with web-based attacks, OWASP Top 10, network-based DoS, brute force, HTTP-based DoS, denial of service, and network/system-based attacks.

• Awareness of SANS Top 20 Critical Security Controls.

• Knowledge of enterprise Windows security, including Active Directory, Windows security architecture and terminology, privilege escalation techniques, mitigation controls, and system hardening.

• Experience with anti-virus and host-based intrusion prevention systems.

• Experience monitoring at least one commercial AV solution, such as McAfee/Intel, Symantec, Sophos, or Trend Micro.

• Familiarity with XSOAR, Anvilogic, Azure/Entra ID, CrowdStrike Falcon, Recorded Future, Proofpoint TAP/TRAP, Egress, Microsoft Defender Explorer, and ServiceNow preferred/helpful.

• PowerShell skills beneficial; KQL skills advantageous.

• Ability to identify common false positives and propose tuning solutions.

• Understanding of malware root causes and proactive mitigation strategies.

• Knowledge of malware propagation within enterprise environments.

• Awareness of web-based exploit kits and their methodologies.

• Familiarity with Advanced Persistent Threats and targeted malware.

• Experience and comprehension of malware protection tools such as FireEye in an enterprise setting.

• Knowledge of covert channels, egress, and data exfiltration techniques.

• Familiarity with vulnerability scoring systems like CVSS.

• Basic understanding of vulnerability assessment tools and exploitation frameworks.

• Willingness to work a 2nd-shift schedule, 4x10 Wednesday-Saturday, 2pm-midnight EST, with flexibility to rotate between days, mids, and nights.

🏝️ Benefits

• A company dedicated to our inclusive values through Employee Resource Groups.

• Work/life balance.

• Access to professional training resources.

• Opportunities for creative problem-solving and engaging in unique, complex projects.

• Volunteer opportunities through “Optiv Chips In.”

• The necessary technology and ability to work productively from home (where applicable).