Incident Response L3

We are seeking a Cyber Security Specialist to join the Security Operations team. The

specialist will serve on the front lines of Security team and will lead and support

security investigations across the companys global infrastructure as well as respond to

escalations from different entities. The specialist will leverage an armory of tools to investigate

and respond to both external and internal security threats. Utilizing company's tooling, you will

monitor security events in real-time, assess external and internal threats, and provide accurate

and timely response. You will collaborate closely with multiple product team within the Tribe,

with a diverse set of skills to tackle the array of security challenges that we encounter.

Security Specialist, Incident Response Responsibilities includes:

• Lead security incident response in a cross-functional environment and drive incident

resolution.

• Lead and develop Incident Response initiatives that improve company's capabilities to

effectively respond and remediate security incidents.

• Perform digital forensic investigations and analysis of a wide variety of assets including

endpoints.

• Perform log analysis from a variety of sources to identify potential threats.

• Build automation for response and remediation of malicious activity.

• Write complex search queries in the EDR as well as SIEM tools for hunting the

adversaries.

• Works on SOAR cases, automation, workflow & Playbooks.

• Integrating and working on Identity solutions.

• Developing SIEM use cases for new detections specifically on identity use cases.

Minimum Qualifications:

• 5-10 years of experience in Security Incident Response, Investigations

• Working experience in Microsoft On-prem and Entra ID solutions

• Good knowledge in Active Directories and Tier 0 concepts

• Very good knowledge of operating systems, processes, registries, file systems, and

memory structures and experience in host and memory forensics (including live

response) on Windows, macOS and Linux.

• Experience investigating and responding to both external and insider threats.

• Experience with attacker tactics, techniques, and procedures (MITRE ATT&CK)

• Experience analyzing network and host-based security events