Associate Principal, Threat Intelligence Full Time

*Hybrid role, 3 days onsite, 2 days remote*

A prestigious financial firm is on the search for an Associate Principal, Cyber Threat Intelligence. This person will need to have at least 2-3 years of experience with some of the following: cyber threat analysis, digital computer forensics, incident response, application security, operating systems security, etc.

Responsibilities:

• Intelligence analysis
• Adversary TTP analysis in network and host-based attacks
• Vulnerability assessment tools (Qualys, Nessus, nmap, etc.)
• Incident Response activities
• Log analysis technologies (SIEM, network sniffers, etc.)
• Other Security preventative and detective technologies (EDR, network-based analysis, etc.)
• Standard technical writing tools including MS Word, Excel, Project and Visio
• Identify enhancements of current threat and situational intelligence sources leveraging proprietary enterprise data, as well as a variety of external sources and open source data.
• Develop and support briefings to Security management on security threats.
• Create and conduct presentations on current threats and related IT Security topics.
• Develop and report threat hunting hypotheses based on applicable security threats to the organization.
• Execute threat hunting operations based on hypotheses reports across varied environments.
• Report observations found during threat hunting in detail to support development of organization’s security posture.
• Perform security incident response activities including investigation, coordination, review, and reporting.
• Execute technical analysis of security events while coordinating incident response activities with internal and external teams.
• Ensure collection and preservation of data associated with cyber security incident response activities follow industry best practices and established procedures.
• Oversee process of monthly reporting to Security management on Threat, Vulnerability, and Incident management metrics.
• Technical understanding of adversarial activities to support threat hunting and purple team operations.
• Incident response experience, taking initiative; providing and following through on solutions across various skillsets.

Qualifications:

• Scripting and development activities to appropriately leverage Application Programing Interfaces (APIs) to optimize integrations between disparate security monitoring and analysis devices
• Bachelor’s degree in Computer Science, Engineering, or another related field.
• 3-5 years of information security experience, preferably in the financial services industry.
• Minimum one year hands-on security operations experience including interdisciplinary experience with four or more of the following: Cyber Threat Analysis, Digital Computer Forensics, Incident Response, Application Security, Operating Systems Security, Cryptographic Controls, Networking, Programming languages, Incident Response
• Familiarity with computer network exploitation and network attack methodologies while maintaining an understanding of the relationship these activities have with the financial services industry and critical infrastructure.
• Industry knowledge of leading-edge security technologies and methods
• Shift work and working in an on-call response capacity is required including availability for 24 x 7 on-call support responsibilities.
• Strongly prefer at least one of the following certifications: CISSP, GCTI, GCIA, GCIH, GCFA, CHFI, CCE, CFE

Tagged as: PHybrid, role