Network Detection and Response (NDR) Specialist

Job Description

Seeking a skilled and proactive Network Detection and Response (NDR) Specialist to join our cybersecurity team. The ideal candidate will be responsible for monitoring, detecting, investigating, and responding to network-based threats using advanced NDR platforms. This role is crucial in strengthening our organizations threat detection capabilities and reducing cyber risks in real time. Key Responsibilities: Monitor network traffic to detect malicious or anomalous activity using NDR solutions (e.g., Darktrace, Vectra, ExtraHop, Corelight). Configure, maintain, and fine-tune NDR tools to optimize detection capabilities and minimize false positives. Conduct deep-dive analysis of network events to identify indicators of compromise (IoCs) and tactics, techniques, and procedures (TTPs). Collaborate with SOC analysts, threat hunters, and other teams to contain and remediate threats. Perform forensic investigations of network packets and flows using tools such as Wireshark, Zeek, or Suricata. Develop detection rules, playbooks, and alerting mechanisms aligned with MITRE ATT&CK framework. Assist in threat intelligence enrichment and correlation with network-based alerts. Prepare root cause analyses, and recommendations for enhancing network security posture. Stay current on emerging threats, attack techniques, and NDR technologies. Required Qualifications: Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or related field (or equivalent experience). 35 years of experience in cybersecurity, with at least 2 years focused on NDR or network security. Hands-on experience with one or more NDR platforms (Vectra AI, Darktrace, ExtraHop, etc.). Strong understanding of network protocols (TCP/IP, DNS, HTTP, etc.) and packet analysis. Familiarity with threat detection and response processes.• Working knowledge of SIEM platforms, firewalls, IDS/IPS, and EDR solutions. Experience using MITRE ATT&CK, PCAP analysis, and threat intelligence feeds. Preferred Qualifications: Certifications such as GCIA, GCIH, CEH, CISSP, or equivalent. Experience in scripting (Python, PowerShell, Bash) for automation and data analysis. Knowledge of cloud environments (AWS, Azure, GCP) and their networking components. Experience integrating NDR with SOAR/SIEM for automation and correlation. Key Skills: Analytical mindset with strong problem-solving skills. Ability to work under pressure Excellent verbal and written communication skills. Team player with the ability to collaborate across technical and non-technical teams