Incidence Response Specialist​/Brooklyn, NY; onsite

Incidence Response Specialist

Client seeking for a full-time Cyber Security Engineer with strong Incidence Response skills. The successful candidate will:

• Monitor tools to detect intrusions and threats
• Be a power user of Splunk SEIM
• Perform real-time cyber defense incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, and direct system remediation) tasks to support deployable Incident Response Teams (IRTs)
• Conduct threat analysis and assessments on network/systems. Monitor, maintain, update, and secure infrastructure.
• Establish, maintain and execute all components of an incident response plan, including run books, from incident intake through root cause analysis, technical remediation analysis, and reporting
• Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system (IDS) logs) to identify possible threats to network security.
• Execute cyber defense incident triage, to include determining scope, urgency, and potential impact, identifying the specific vulnerability, and making recommendations that enable expeditious remediation
• Perform initial, forensically sound collection of images and inspect to discern possible mitigation/remediation on enterprise systems.
• Accurately documenting an incident from beginning to end as well as evidence handling.
• Perform security operations tasks
• Provide expertise in integration and engineering of security platforms.

Required Skills

• 5 years or more experience working in a complex enterprise environment
• Have previous experience performing threat hunting and incident response duties using SIEM tools, cybersecurity management tools
• Knowledge of Malware Analysis, Reverse Engineering, and Host-based and Memory Forensics tools and techniques.
• Deep understanding of computer intrusion activities, incident response techniques, tools, and procedures
• Knowledge of digital forensics methodology
• Strong understanding of vulnerability and exploitation concepts
• Strong experience in firewalls, IDS/IPS, DNS, SEIM, cybersecurity tools.
• Knowledge of datacenter technologies and architecture.
• Knowledge of IPv4/IPv6 based networks, subnetting, and routing protocols.
• Knowledge of operating systems including Linux/Unix and Windows
• Experience with programming languages such as Python, Perl, C/C++, Power Shell, etc.
• Experience with security assessment tools such as NMAP, Netcat, Nessus, Net Witness, Net Brain, Extra Hop and Metasploit is a plus.
• Strong cross-functional team leadership skills.
• Excellent written and verbal