Digital Forensics/Incident Response Examiner
Posted on Nov 6, 2020 by Request Technology - Robyn Honquest
Incident Response Forensics Examiner
Selling Point: Keys to this role are incident handling, threat intelligence, threat hunting, digital forensics examiner, incident response, log analysis. You will support the global fusion center forensics analysis malware analysis and reverse engineering
We are seeking an experienced Digital Forensics Incident Response candidate to perform intelligence-driven network defense supporting the Global Security Fusion Center (GSFC) capabilities (Incident Handling, Threat Intelligence, Threat Hunting and other stakeholders for GSFC). The role involves forensic analysis of online and offline (dead-box) hosts and network logs associated with information security incidents discovered by the System-level Monitoring and Threat Hunting capabilities.
- Identify key data points regarding information security incidents, such as root-cause analysis, possible attack methods and techniques, malware infection and persistence methods, etc.
- Must understand the life cycle of an Incident and tools used to determine root cause during an incident.
- Operation understanding on reverse engineering malware.
- Perform network, disk, system files and memory forensic analysis.
- Custom tool design to assist in analysis and investigation. (Related experience in programming, database, system administration, etc.).
- Implementing integration/orchestration of existing and new forensic infrastructure and tools.
- Perform custom analysis on (centralized) security event information to analyze incidents.
- Collaborate with Engineering on the development of detection signatures and correlation use cases when appropriate.
- Perform as an Information Security SME in the following areas:
- Digital Forensics
- Incident Response
- Log analysis
- Popular operating systems (Windows, Mac, Linux, Android, etc.)
- Networking (Firewalls, IDS/IPS, packet capture)
- Other security related disciplines
- Continued collaboration and support with teammates, as well colleagues as it pertains to incident analysis
- Bachelors and/or Masters Degree
- 5+ years overall technical experience in either forensics, threat intelligence, incident response, security operations, or related technical information security field.
- Deep understanding of common network and application stack protocols, including but not limited to TCP/IP, SMTP, DNS, TLS, XML, HTTP, etc.
- Strong Incident Handling experience.
- Strong and recent experience with malware analysis and reverse engineering.
- Strong experience with popular OS architectures (eg Russinovich's Windows Internals, Linux Kernel architecture, etc.).
- Experience with security operations tools, including but not limited to:
- Threat Intelligence Platforms
- Link/relationship analysis (eg Maltego, IBM i2 Analyst Notebook)
- Signature development/management (eg Snort rules, Yara rules)
- Broad experience with various common security infrastructure tools (NIDS, HIPS, EDR, etc.).
- Excellent analytical and problem solving skills, a passion for research and puzzle-solving.