Threat Analyst, Sophos

• Willingness to work outside of standard business hours, including weekends and holidays – our MDR service is 24x7x365
• Excellent troubleshooting and analytical skills, with proven ability to think outside the box
• Customer service-oriented with strong written and verbal communication skills
• Must thrive within a team environment as well as on an individual basis
• Passion for all things related to information technology and cybersecurity
• Natural curiosity and ability to learn new skills quickly
• Innovative mindset and driven to contribute to a team providing a best-in-class cybersecurity service
• Minimum 4+ years of experience working in a SOC environment or computer security team in an IT environment
• Experience with threat hunting
• Experience with endpoint and network security monitoring
• Experience administering and supporting Windows OS (both workstations and server) and one of the following: Apple or Linux-based operating systems (e.g. XP, Windows 7, 2003, 2008, OS X)
• Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc
• Knowledge of Mitre ATT&CK framework
• Knowledge of incident response procedures
• Basic understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc
• Basic understanding of Windows event log analysis
• Experience with SQL query construction

Desirable

• As a Threat Analyst on our Managed Threat Response (MTR) team, you will provide best-in-class monitoring, detection, and response services to proactively defend customer environments before attacks prevail
• You will work alongside and contribute to a team of cyber threat hunters, incident response analysts, engineers, and ethical hackers by using enterprise, log analysis and endpoint collection systems to facilitate investigations, identification, and neutralization of cyber threats
• Investigate and analyze logs and security-related events via Sophos tooling
• Identify and respond to cyber threats occurring within customer environments
• Communicate and document findings to various customer audiences including technical and executive teams
• Follow up with customers through to issue resolution and drive continuous improvement by providing detailed recommendations to minimize risk in customer environments
• Acknowledge and satisfy inbound customer requests and interact with customers through various mediums
• Collaborate and assist with core security and threat response teams
• Actively research emerging Indicators of Compromise/Attack, exploits and vulnerabilities with the intent of operationalizing findings to better protect our customers