Team Lead, MDR-Information Security Engineer

What you will do

• Manage operational tasks and provide day-to-day oversight for the InfoSec Engineering team
• Oversee engineers in their investigation and response activities when security incidents arise to determine possible cause and resolution
• Prioritize daily work tasks and delegate responsibilities as a means of adhering to service level targets (SLTs)
• Effectively communicate information to stakeholders of all levels
• Act as a lead throughout incident scenarios and provide subject matter expertise in cybersecurity incident response
• Successfully execute incident handling procedures as well as direct response to cyber security incidents
• Maintain current knowledge and recognition of attacker tools, tactics, and procedures to produce indicators of compromise (IOCs) that can be utilized during active and future investigations
• Conduct regular quality checks on cases and calls to ensure compliance with case handling procedures, thereby maintaining operational efficiency and adherence to standards
• Assess cyber threat intelligence/open-source intelligence and operationalizing that information
• Identify current and emerging threats and application of such research
• Assess cyber threat intelligence/open-source intelligence and operationalizing that information
• Identify current and emerging threats and application of such research

What you will bring

• 5-10 years of experience within a cybersecurity environment; experience in a leadership role is preferred
• Experience in a security operations center, or similar environment, and identifying indications of compromise or attack and responding to incidents
• Endpoint and network security experience required; IDS, IPS, EDR, ATP, Malware defenses and monitoring experience
• Threat hunting experience preferred
• Knowledge of common adversary tactics and techniques, e.g., obfuscation, persistence, defense evasion, etc.
• Knowledge of Mitre ATT&CK framework preferred
• Working knowledge of incident response procedures
• Experience with SQL query construction preferred
• Experience with OSQuery is a plus
• Experience administering and supporting Windows OS (both workstations and server) and one of the following: Apple or Linux-based operating systems (e.g. XP, Windows 7, 2003, 2008, OS X)
• Fundamental understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
• Strong understanding of Windows event log analysis
• Experience with enterprise information security data management - SIEM experience a plus
• Programming and scripting skills - proficient knowledge of Powershell is a plus
• Excellent troubleshooting and analytical thinking skills
• Strong documentation and communication skills
• Advanced Cyber Security certifications preferred but not required
• Excellent customer service skills
• Passion for all things information technology and information security
• Natural curiosity and ability to learn new skills quickly
• Ability to think outside the box
• Innovative mindset