Forensics and Incident Response Engineer
Posted on Jan 25, 2020 by Request Technology - Craig Johnson
Prestigious Fortune 500 Company is currently seeking a Digital Forensics and Incident Response Engineer.
Candidate will perform intelligence-driven network defense supporting security capabilities (Incident Handling, Threat Intelligence, Threat Hunting). The role involves forensic analysis of online and offline hosts and network logs associated with information security incidents discovered by the System-level Monitoring and Threat Hunting capabilities. The role is supported by large amounts of data from vendor SaaS tools and internal sources, including various indicator feeds, SIEM, several threat intelligence tools, etc. in order to assist the role in contributing a near-complete technical understanding of information security incidents. The candidate will perform the functions of a digital forensics examiner and collaborate with other teams.
- Identify key data points regarding information security incidents, such as root-cause analysis, possible attack methods and techniques, malware infection and persistence methods, etc.
- Must understand the life cycle of an Incident and tools used to determine root cause during an incident.
- Operation understanding on reverse engineering malware.
- Perform network, disk, system files and memory forensic analysis.
- Custom tool design to assist in analysis and investigation. (Related experience in programming, database, system administration, etc.).
- Implementing integration/orchestration of existing and new forensic infrastructure and tools.
- Perform custom analysis on (centralized) security event information to analyze incidents.
- Collaborate with Engineering on the development of detection signatures and correlation use cases when appropriate.
- Perform as an Information Security SME in the following areas:
- Digital Forensics
- Incident Response
- Log analysis
- Popular operating systems (Windows, Mac, Linux, Android, etc.)
- Networking (Firewalls, IDS/IPS, packet capture)
- Other security related disciplines
- Continued collaboration and support with teammates, as well colleagues as it pertains to incident analysis
- Bachelors and/or Masters Degree in Engineering, Computers Science, or related field.
- 5+ years overall technical experience in either forensics, threat intelligence, incident response, security operations, or related technical information security field.
- Deep understanding of common network and application stack protocols, including but not limited to TCP/IP, SMTP, DNS, TLS, XML, HTTP, etc.
- Strong Incident Handling experience.
- Strong and recent experience with malware analysis and reverse engineering.
- Strong experience with popular OS architectures (eg Russinovich's Windows Internals, Linux Kernel architecture, etc.).
- Experience with security operations tools, including but not limited to:
- Threat Intelligence Platforms
- Link/relationship analysis (eg Maltego, IBM i2 Analyst Notebook)
- Signature development/management (eg Snort rules, Yara rules)
- Broad experience with various common security infrastructure tools (NIDS, HIPS, EDR, etc.).
- Excellent analytical and problem solving skills, a passion for research and puzzle-solving.
- Expert understanding of large, complex corporate network environments.
- Strong communication (oral, written, presentation), interpersonal and consultative skills, especially in regard to white papers, briefs, and presentations.