Cyber Threat Investigator

Key Responsibilities:

The Cyberwatcher is responsible for:

• Maintain expert knowledge of Advanced Persistent Threat (APT) Tools, Techniques and Procedures

(TTPs), forensics and incident response best practices.

• Use threat intelligence and threat models to build threat scenarios.

• Prepare and conduct threat-hunting campaigns to check threat scenarios.

• Research, analyze and correlate a wide range of data sets from any source.

• Proactive and iterative research into systems and networks to detect advanced threats.

• Reporting risk analysis and threat findings to the relevant stakeholders.

• Identify and provide automated alerts for emerging and historically unknown threats.

• Co-operate with multiple teams within operations, intelligence and engineering to continuously

improve security checks and detection performance.

• Participate PTXs (purple team exercises) by monitoring new detection capabilities.

• Manage reports, dashboards, metrics for CyberSOC KPIs and presentation to senior management &

other stakeholders.

• Work closely with key stakeholders in technology, application, and cybersecurity to develop

targeted use cases addressing specific advanced persistent threat (APT) behaviors.

Key Performance Indicators:

The Cyberwatcher is responsible for:

• Maintain expert knowledge of Advanced Persistent Threat (APT) Tools, Techniques and Procedures

(TTPs), forensics and incident response best practices.

• Use threat intelligence and threat models to build threat scenarios.

• Prepare and conduct threat-hunting campaigns to check threat scenarios.

• Research, analyze and correlate a wide range of data sets from any source.

• Proactive and iterative research into systems and networks to detect advanced threats.

• Reporting risk analysis and threat findings to the relevant stakeholders.

• Identify and provide automated alerts for emerging and historically unknown threats.

• Co-operate with multiple teams within operations, intelligence and engineering to continuously

improve security checks and detection performance.

• Participate PTXs (purple team exercises) by monitoring new detection capabilities.

• Manage reports, dashboards, metrics for CyberSOC KPIs and presentation to senior management &

other stakeholders.

• Work closely with key stakeholders in technology, application, and cybersecurity to develop

targeted use cases addressing specific advanced persistent threat (APT) behaviors