Sr. Security Incident Response Engineer

The Security Incident Response Team (SIRT) Engineers support the business operations of SIE through rapid mitigation of all high severity cyber security incidents. They support and coordinate incident response within the organization, serve as a trusted point of contact and clearinghouse for security incident-related information. They cooperate with other security teams within broader Sony and the gaming industry. They work very closely and collaborate with the SOC, Threat Intelligence and Engineering teams. This team is a highly technical team, with extensive hands-on role in a dynamic and fast-paced environment. The candidate will need to have a good mixture of deep technical know-how as well as a background in various information security concepts. SIRT Engineers are also responsible for the ongoing development and improvement of intrusion detection rules, threat hunting activities, the incident response plan (IRP) and other department related documentation.

Essential Duties and Responsibilities:

• Responding to critical incidents, threats, actively exploited vulnerabilities and bring these issues to resolution. Actively drive incident response, document and communicate findings, coordinate efforts and provide regular updates to leadership; act as the incident commander.
• Conduct detailed investigations using multiple tools and methods to correlate and analyze relevant events from various sources.
• Able to perform digital forensics investigations and malware analysis, perform live response data collection and analysis on hosts of interest in an investigation.
• Perform proactive threat hunting activities to search across the environment for indicators of compromise using available technology.
• Continually create new knowledge base articles and pattern discovery to be used for discovery, alerting and detection; contribute to content development for detection purposes (content engineering).
• Position includes on call responsibilities.
• Maintain current knowledge of tools and best-practices in advanced persistent threats; tools, techniques, and procedures of attackers; forensics and incident response.
• Manage and improve the forensic analysis environment including forensic evidence acquisition and analysis tools. Use and expand the capabilities of existing analytical tools and technologies; recommend new technologies as appropriate; Improve and challenge existing processes and procedures.

Required Experience, Skills and Knowledge:

• Bachelor of Science or equivalent experience in Computer Science, Computer Engineering, Information Technology, Cyber Security, Intelligence studies.
• 5+ years of experience in a hands-on technical role working within the Information Security Field, with emphasis on Intrusion Detection, Incident Response, Digital Forensics and Malware Analysis.
• Ability to prioritize and implement in a methodical manner, as well as to set and handle expectations with senior leadership and team members. Ability to analyze complex problems, quickly develop creative solutions, and adapt to a fast-paced environment. A good ability to multi-task and manage varying priorities.
• Excellent verbal and written communication and presentation skills, high attention to detail.
• Solid understanding of and hands-on experience with operating systems (Windows, Linux, OS X) and web applications. Proficiency in networking concepts. and experienced in network device configuration, routing, switching and firewalling.
• Solid experience with and knowledge of application security, network security and endpoint security tools.
• Proficient with one or more scripting languages such as Perl, Python, PowerShell etc. in an incident handling environment.
• Hands-on experience in cloud-based environments such as AWS, Azure, GCP.
• Hands-on experience in digital forensics and tools associated with the task such as Axiom, FTK, GRR, X-Ways, Volatility, Surge, Rekall, BlackLight, MacQuisition
• Advanced knowledge and experience with Splunk and/or Kibana.
• Experience and proficiency with any of the following: Intrusion analysis, Host-Based Forensics, Network Forensics, Malware Analysis concepts and methods.

Desired:

• Experience in red/purple teaming or penetration testing.
• Experience in reverse engineering malware and tools associated with the task such as IDA Pro, OllyDbg, Radare2
• One of more certifications such as GIAC GCIA, GCIH, GCFE, GCFA, GREM is a plus, but skill level carries more weight

#LI-GM1