Head of Threat Response, Cisco Meraki

• Typically have 6+ years in Cybersecurity Incident Response roles, primarily passionate about leading sophisticated incidents involving multi-functional teams
• Understand common threat actor tactics, techniques, and procedures (TTPs) and how they are chained together
• Have experience leading threat hunts, using available logs and threat intelligence to proactively identify and investigate potential risks and suspicious behavior
• An understanding of major security compliance frameworks such as PCI, SOC 2, and FedRAMP as they relate to incident monitoring and response
• Basic SQL Programming experience for reporting
• Have familiarity with the following tools:
• File Integrity Monitoring (FIM)
• Vulnerability Scanners
• Network and Host Intrusion Detection (IDS) such as SNORT/Sourcefire, Palo Alto, etc
• Incident Response Case Management Tools
• Network sniffers and packet tracing tools such as DSS, Ethereal, tcpdump, Wireshark, etc

Desirable

• The Threat Management Response team is responsible for 24x7x365 monitoring and rapid incident response for all Cisco Meraki environments
• We are the last line of defense to protect the company and our customer's data from our threat actors and adversaries
• You will have a significant impact on the security of millions of Cisco Meraki users all around the world!
• Incidents can happen at any time, as such this position requires on-call work (including overnight and weekends) on a rotational basis
• The core hours for this position are 9:30 AM - 6:30 PM PST (in the time zone you are hired for), Monday through Friday
• Serve on a rotation of security incident commanders, work with heads of every major product team to ensure a quick mobilization for high-severity incidents
• Experience responding to high severity incidents and handling the remediation process. (e.g. Malware analysis, large scale phishing attacks, production intrusion, etc.)
• Investigate security events for the following platforms and technologies:
• Cloud (AWS, Azure, GCP)
• Windows/Mac/Linux OS
• Cisco physical and virtual network devices and platforms
• Perform basic forensics when security incidents occur
• Develop, document, and lead initiatives to improve Incident Response strategies, runbooks, capabilities, and technologies