Cyber Defense - Cyber Triage and Forensic Analyst

• Perform forensic and malware analysis to detect, investigate, and resolve security incidents, including artifact classification and payload extraction
• Engage in proactive threat hunting and provide expert security assessments, utilizing EDR, SIEM, and other tools to understand and counteract the cybercrime landscape
• Communicate with IT stakeholders during incident response activities, ensuring effective containment, remediation, and accurate identification of compromise indicators
• Report on incident metrics, analyse findings, and develop reports to ensure comprehensive resolution and understanding of security events
• Act as an escalation point for incident response, shift lead, mentor junior team members, and contribute to team skill enhancement
• Analyse security events, provide feedback on security controls, and drive process improvements to strengthen the organizations security posture
• Maintain and improve security incident processes, protocols, and standard operating procedures to reflect best practices in security incident response
  

• Proficient in digital forensics, including evidence management in line with best practices and using advanced tools for threat detection and incident management including advanced querying with KQL
• Skilled in analyzing diverse data, identifying malware, and employing reverse engineering to reveal hidden threats
• Proficient in conducting detailed forensic investigations across various operating systems, with a keen eye for obfuscation and the ability to clearly communicate findings
• In-depth understanding of Active Directory security, with strong scripting abilities to automate response measures and improve operational effectiveness

To qualify for the role, you must have

• Undergraduate or Postgraduate Degree in Computer Science, Engineering, or a related field (MCA/MTech/BTech/BCA/BSc CS or BSc IT)
• At least 7 years of overall experience with a minimum of 5 years specialized in incident response, computer forensics, and malware reverse engineering
• Proficiency in operating within a Security Monitoring/Security Operations Center (SOC) environment, including experience with CSIRT and CERT operations
• Demonstrated experience in investigating security events, threats, and vulnerabilities
• Strong understanding of electronic investigation and forensic methodologies, including log correlation, electronic data handling, investigative processes, and malware analysis
• In-depth knowledge of Windows and Unix/Linux operating systems, and experience with EDR solutions for threat detection and response