30 Snort Jobs

Who You'll Work With : Cisco is offering an extraordinary opportunity to be part of an innovative team with a low process, high throughput culture. We are looking for a highly energetic Software Engineering who can combine technical acumen of network security engineering with strong analytical skills. The team is playing a crucial part in leading breakthrough cloud-delivered security capabilities to the thousands of Cisco current and future customers worldwide. Today, we handle more than 80 billion daily Internet requests from 65 million+ users around the world. Though we take phenomenal pride in being market leaders in threat security for long time, we are constantly innovating and improving our solutions to address the ever-changing threat perceptions and changing data security paradigms so that our customer networks are always secured. We take our customers trust in us very seriously and go all the way to ensure we protect their data all times. Our team works on leading Network Intrusion Detection & Prevention System solutions that are all-star, scalable and easily manageable. Our network security portfolio and cloud delivered services cover a wide spectrum of security solutions spanning - Firepower Threat Defense, Snort, Cisco SecureX, Secure Internet Gateway, DNS security. Working at Cisco Network Security means being surrounded by passionate, intelligent and creative people that are determined to disrupt the Internet security industry with creative ideas, world-class research and unrivalled products and services. It’s a place where the best ideas are quickly transformed into products, features, campaigns and company-wide practices, so it won’t be long before you witness the results of your hard work. What You'll Do: Participate in test planning and testing the New/Existing Functionality in the Product Ability to focus on deep internal aspects of the feature and its integration with the OS Should learn new features, technologies and platforms in a relatively short amount of time Work closely with customer support to provide timely resolution of problems Hands on with Lab setup’s and Automation Who You Are: 4+ years of experience in Networking/Security Domain Testing Proficient in - TCP/IP networking and network management, IPv6 Expertise on - Network security (Intrusion prevention / Intrusion detection / NAT / Access-list / IPSEC and SSL VPN / TLS) Experience and knowledge on - Routing & Switching (OSPF / BGP / EIGRP / VLAN / STP / DHCP / multicast) Should have worked in Virtual technologies (ESXi, KVM, AWS, Azure, OCI) Hands-on experience with Legitimate and Malware Application Traffic generator tools, Linux, Windows, Packet tracer, Wireshark and tcpdump Tools Familiar with - Palo Alto, Checkpoint, Juniper, Fortinet products preferred Strong automation background on python, Java etc. Should have experience in UI & API based test automation Experience in DevOps, Continuous integration and Continuous delivery tools are added advantage. Able to setup Lap topologies from scratch. Why Cisco #WeAreCisco, where each person is outstanding, but we bring our talents to work as a team and make a difference powering an inclusive future for all. We embrace digital, and help our customers implement change in their digital businesses. Some may think we’re “old” (36 years strong) and only about hardware, but we’re also a software company. And a security company. We even invented an intuitive network that adapts, predicts, learns and protects. No other company can do what we do – you can’t put us in a box! But “Digital Transformation” is an empty buzz phrase without a culture that allows for innovation, creativity, and yes, even failure (if you learn from it.) Day to day, we focus on the give and take. We give our best, give our egos a break, and give of ourselves (because giving back is built into our DNA.) We take accountability, bold steps, and take difference to heart. Because without diversity of thought and a dedication to equality for all, there is no moving forward. So, you have colorful hair? Don’t care. Tattoos? Show off your ink. Like polka dots? That’s cool. Pop culture geek? Many of us are. Passion for technology and world changing? Be you, with us! Show more Show less

About noon noon, the region's leading consumer commerce platform. On December 12th, 2017, noon launched its consumer platform in Saudi Arabia and the UAE, expanding to Egypt in February 2019. The noon ecosystem of services now includes marketplaces for food delivery, quick-commerce, fintech, and fashion. noon is a work in progress; we’re six years in, but only 5% done. noon’s mission: every door, everyday. What we are looking for Noon’s Cybersecurity department, Security operations team is looking for a talented, experienced, and enthusiastic Senior Threat Detection Engineer to help build and scale the Detection & Threat Hunting program at Noon. The ideal candidate will be someone who has diverse security skill-set (IR, TI, SOC..) and specialized in detecting engineering and threat hunting. The focus area for this role will be on designing and implementing advanced detection mechanisms based on known/emerging attacks and pivoting techniques. The Sr. Threat Detection will be working on proactive approaches to advance steps ahead of attackers and help in building detection to identify advanced, current and emerging threats. He will be responsible for the design and implementation of security intelligence and detection capabilities across our applications and networks. This role will be assisting in building the strategy and the team for our Detection and Threat Hunting Program. He will be the focal point for the planning and execution of security investigation, response process and coordination of relevant parties when an information security incident occurs. In addition, documentation, analytical and critical thinking skills, investigation and forensics, and the ability to identify needs and take the initiative are key requirements of this position. About the role Help build and scale the Detection & Threat hunting Program at Noon Drive improvements in detection and response capabilities, and operations for the Internal SOC/TI Write detection signatures, tune security monitoring systems/ tools, develop automation scripts and correlation rules. Work closely with other Security Team members to strengthen our detection and defence mechanisms in regards to, Web applications, Cloud and Network. Exhibit knowledge of attacker lifecycle, TTPs, indicators of compromise (IOCs), and proactively implementing countermeasures to neutralize the threats. Identifies opportunities to enhance the development and implementation of new methods for detecting attacks and malicious activities. Participate as a member of the CSIRT during major incidents and lend contributions to post-Incident review and continuous improvement Proactive threat hunting of anomalies to identify IOCs and derive custom snort signatures for the IOCs Identifying and managing a wide range of intelligence sources to provide a holistic view of the threat landscape. (OSINT aggregation) Work closely with the Red Team and Blue Team to implement custom detection of new and emerging threats, and develop monitoring use cases. Coordinate in red teaming activities such as table-top and adversarial simulation exercises. Responsible for owning all confirmed incidents. This includes publishing Incident Report, documenting Lessons Learnt and updating Knowledge Base. Required Expertise: Required: Senior level experience in a threat intel, detection, IR, or similar cybersecurity roles for medium to large organizations. Required: Technical professional security certifications in Incident Response, Digital Forensics, Offensive Security, or Malware Analysis, such as GCIH, GCFA, GNFA, GCTI, OSCP or similar Bachelor’s degree in Computing, Information Technology, Engineering or a related field, with a strong security component. Hands-on experience in detection engineering, advanced cyber threat intelligence activities, intrusion detection, incident response, and security content development (e.g., signatures, rules, etc.) A broad and diverse security skill-set with an advanced understanding of modern network security technologies (e.g. Firewalls, Intrusion Detection/Prevention Systems, Access Control Lists, Network Segmentation, SIEMs, Auditing/Logging and Identity & Access Management solutions, DDoS protection etc.). Knowledge of at least one common scripting language (Python, Ruby, Go). Experience handling and building a SOAR such as Chronicle’s SOAR, Demisto, Phantom or similar tools. Experience conducting and leading incident response investigations for organizations, investigating targeted threats such as the Advanced Persistent Threat, Insider Threats .. etc. Understanding of log collection and aggregation techniques, Elastic Search, Logstash, Kibana (ELK), Syslog-NG, Windows Event Forwarding (WEF), etc. Experience with endpoint security agents (Carbon Black, Crowdstrike, etc.). Preferred Qualifications: Hands on experience with Chronicle SIEM/SOAR and Google SecOps Expertise in threat hunting in one or more public cloud solutions such as AWS and GCP Ability to work with a team or independently with minimal direction/leadership Hands-on experience in offensive/defensive web applications security is a big plus for this role. Highly motivated and self-directed with a passion for solving complex problems Establishes industry expertise through writing, speaking or online presence. Who will excel? We’re looking for people with high standards, who understand that hard work matters. You need to be relentlessly resourceful and operate with a deep bias for action. We need people with the courage to be fiercely original. noon is not for everyone; readiness to adapt, pivot, and learn is essential. Show more Show less

Company Description CyberDisti is a next-generation cyber security value-added distributor offering comprehensive cyber security solutions tailored to meet clients' specific needs. Our vision is to provide advanced cyber security solutions to facilitate secure digital transformation for our customers. By partnering with leading vendors in the industry, CyberDisti holds a unique competitive advantage in delivering cutting-edge cyber security products and solutions. Job Description Analyze and investigate security events from various sources. Manage security incidents through all phases of the incident response process through to closure Using SIEM, Full Packet Capture, Intrusion Detection, Vulnerability Scanning and Malware analysis technologies for even detection and analysis. Update tickets, write incident reports and document actions for false positive reduction Developing knowledge of attack types and fine-tuning detective capabilities such as writing Snort/Sourcefire signatures Incident validation Detailed analysis of attacks and incident response Solution recommendation for issues Manage security devices Risk analysis for change management for security devices Escalation points for device issue resolution · Resolve escalation, Identified missed incidents, maintain knowledge base, defining security breaches Follow-up with the concerned departments/vendor on the remediation steps taken Resolve queries from Client’s stakeholders Coordinate and be present to discuss with Client stakeholders in person Qualifications & Skills 1+ years of experience in working with SIEMs/SEMs and other log analysis technologies Bachelor's in computer science or computer engineering Detailed understanding of the TCP and IP protocol suites and ability to dissect and explain the contents of traffic and packets. Demonstrated ability to work well independently with little input, and as a part of a team Experience with configuration of debug, event generation and logging functionality within application and operating systems, using Syslog or flat file generation. Operating systems and system administration skills in at least one of the following (Windows, Solaris, Linux) including good command line skills. 3-5 years of experience in SIEM, log monitoring, event correlation and analysis Experience in vulnerability assessments, penetration testing Experience in handling events, patch management, configuration management Understanding of TCP/IP, networking concepts and internet protocols Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today.

JOB PURPOSE: The Head of mXDR Operations is responsible for leading and managing the operational aspects of cybersecurity at the airport, including oversight of the Managed Security Services Provider (MSSP) delivering SOC operations, Threat Hunting, Detection & Prevention, and Incident Response. The role also encompasses direct accountability for Information Security Operations covering both IT and OT (Operational Technology) domains, ensuring a unified and effective defense posture against cyber threats in a critical infrastructure environment. PRINCIPAL ACCOUNTABILITIES: SOC & mXDR Oversight Lead daily operations and governance of MSSP-managed Security Operations Center (SOC) and mXDR services. Review and validate alerts, use cases, playbooks, and tuning recommendations submitted by MSSP. Define and track service level agreements (SLAs), mean time to detect/respond (MTTD/MTTR), and other performance KPIs. Ensure continuous coverage across IT, cloud, and OT assets within the SOC’s visibility and telemetry scope. Collaborate with MSSP to plan capability upgrades (e.g., EDR, NDR, cloud telemetry integration). Optimize the performance of managed XDR solutions to proactively identify and mitigate risks. Monitor and evaluate partner performance, addressing any issues related to quality, cost, or delivery. Threat Hunting & Detection Engineering Guide the proactive hunting of threats across endpoints, networks, OT environments, and cloud workloads. Review hunting hypotheses and analytics built on threat intelligence, behavior analytics, and anomaly detection. Oversee development and refinement of detection rules, correlation logic, and behavioral models. Drive periodic reviews of MITRE ATT&CK coverage and detection effectiveness. Support threat simulation and emulation exercises (e.g., purple teaming) to enhance detection posture. Incident Response & Management Ensure a well-defined incident response plan is in place and regularly tested through simulations. Continuously improve detection and response capabilities based on threat intelligence and industry trends. Conduct post-incident reviews to identify lessons learned and improve processes. Act as the lead coordinator for high-severity and regulatory-reportable cyber incidents. Ensure MSSP follows incident response procedures and escalates as per predefined thresholds. Maintain and test incident response playbooks, RACI charts, and communication protocols. Coordinate evidence collection, forensic analysis, and root cause investigations. Oversee the implementation and verification of post-incident recovery and lessons learned. OT Cybersecurity Operations Work with the ICS Security SME to oversee deployment and operations of OT-specific security controls (e.g., ICS firewalls, passive monitoring). Support ICS Security SME in working with OT vendors and facilities teams to ensure security of SCADA, BMS, and other critical systems. Track vulnerabilities in OT assets and coordinate with ICS Security SME and stakeholders for safe remediation. Monitor lateral movement risks between IT and OT environments and enforce network segmentation. Ensure OT environments are covered in threat detection, logging, and alerting workflows. Information Security Operations Manage day-to-day internal security operations including DLP, endpoint protection, and access monitoring. Review all Change Requests and provide insight & recommendations ensuring CRs/amendments are fit for purpose, negotiated and executed by working with all stakeholders. Ensure critical patches, vulnerabilities, and security misconfigurations are tracked and remediated. Maintain visibility of high-value assets and enforce control compliance (e.g., logging, backup, access). Investigate user behavior anomalies and enforce insider threat detection measures. Coordinate identity and access management reviews for privileged and third-party access. Governance, Reporting & Compliance Generate monthly and quarterly dashboards covering alerts, incidents, SLAs, and threat trends. Report on MSSP adherence to contract deliverables, including risk exposure and gap analysis. Manage escalations as per contracted frameworks. Ensure unresolved escalations are tabled in governance forums and taken up for resolution. Drive the resolution of such escalations by working with all concerned stakeholders Coordinate with compliance teams for audits and regulatory inspections related to cybersecurity. Contribute to cyber risk assessments for critical airport systems and digital services. Ensure alignment with international frameworks (e.g., NIST CSF, ISO 27001, NIS2) and aviation-specific mandates. Strategic Leadership Provide strategic direction and leadership to the MSSP, fostering a culture of excellence and continuous improvement. Drive innovation in information security solutions and practices, ensuring the organization remains competitive and forward-looking. Act as a key advisor on Information Security matters, contributing to strategic decision-making. DIMENSIONS: Financial Optimize operational expenses while delivering high-value outcomes through effective vendor negotiations. Support financial risk mitigation by safeguarding against data breaches, penalties, and other cyber-related losses. Non-Financial Manage the MSSP (both remote and no-premises resources) with day-to-day tasks, review, and guidance on in-scope activities. Assess the skills, capabilities & expectations of the MSSP from time to time and work with MSSP management for right sourcing in BIAL account. Provide inputs on team capacity planning & hiring plans if any Lead and mentor MSSP team, fostering a high-performing team culture. Enhance the organization's ability to respond to and recover from cyber incidents effectively. Competency - Proficiency Level - Description: Cybersecurity Operations - Expert - Deep knowledge in SOC, SIEM, XDR, endpoint, network, and cloud security Threat Detection & Threat Hunting - Advanced - Experience in proactively identifying advanced threats and anomalies Incident Response & Forensics - Advanced - Skilled in leading structured incident response and root cause analysis OT Security - Intermediate - Understanding of OT systems and securing industrial environments Vendor & MSSP Management - Advanced - Strong experience in managing MSSP contracts and delivery governance Information Security Frameworks - Advanced - ISO 27001, NIST, MITRE ATT&CK, CIS Controls Communication & Reporting - Advanced - Capable of translating technical issues into business impact for leadership Risk Management & Compliance - Intermediate - Knowledge of regulatory and critical infrastructure compliance requirements Team Leadership & Collaboration - Advanced - Experience in leading internal security teams and cross-functional teams JOB SPECIFICATION: Knowledge and work skills: Comprehensive understanding of cybersecurity frameworks, technologies, and methodologies (e.g., NIST CSF, ISO 27001, MITRE ATT&CK, ITIL v3, PMP, TOGAF, ISO 20k & 27k and COBIT). Expertise in managed XDR operations, incident response, threat intelligence, and identity management. Familiarity with security architecture principles, ICS/OT security frameworks, and industrial protocols. Adequate knowledge of regulatory standards applicable to the industry. Proficient in process improvement and development practices Strong knowledge of SLA & service management, and operations management. Knowledge with InfoSec tools like: AV/EDR, Data Leakage Prevention, Metasploit, TripWire, Rapid7, Tenable, Snort, Nessus, Burp Suite, Appscan, Nmap, Wireshark, Firewalls, SIEM, SOAR, , SSE, CASB, PIM/PAM, WAF, O365 suite (Intune, Conditional access, Data classification and protection). Skills Minimum 10–12 years of experience in cybersecurity operations, with at least 5 years in a leadership or MSSP governance role. Experience in driving initiatives centered on continuous improvement, innovation, execution excellence, customer centricity and automation Analytical and problem-solving skills for assessing threats, vulnerabilities, and risks in complex environments. Exceptional communication and stakeholder management skills to influence decision-making and secure buy-in. Proven ability to lead cross-functional teams. Ability to build and maintain relationships with internal teams, partners, and external vendors. Qualifications Bachelor’s degree in computer science, Information Security, or a related field (Master’s degree preferred). Certifications such as CISSP, CISM, CISA, CEH, or equivalent are highly desirable. **Please note that this position requires 5 days work from Office. Show more Show less

We are seeking an OT Network Engineer to contribute to the development of an industrial automation and security platform with advanced OT network discovery, device fingerprinting, real-time tracking, and security compliance features . The ideal candidate will have expertise in network scanning, industrial protocols (SNMP, LLDP, ARP), Zero Trust security, IEC 62443 compliance, and PLC inventory management . This role requires hands-on experience in building scalable, secure, and AI-driven OT networking solutions integrated into the platform. Key Responsibilities: OT Network Discovery & Device Fingerprinting Develop and integrate automated network scanning for industrial assets into the platform. Implement passive & active network scanning using SNMP, LLDP, ARP, and industrial protocols. Design and optimize device fingerprinting to classify OT devices (PLCs, SCADA nodes, IIoT gateways, sensors) based on manufacturer, model, firmware, and protocol stack. Enable real-time endpoint tracking and automated asset registration within the platform. 2. Industrial Network Security & Compliance (IEC 62443, Zero Trust) Implement IEC 62443-based security frameworks within the platform to ensure OT network compliance. Integrate Zero Trust security models for industrial endpoints and control networks. Work on network segmentation strategies for isolating critical industrial systems within the platform. Design and develop anomaly detection features for unauthorized device behaviors using AI-based security analytics. 3. SCADA-Integrated Asset Management & Monitoring Contribute to the development of a SCADA-integrated asset inventory system for industrial environments. Develop a real-time monitoring engine for tracking PLC instances, network ports, and communication health. Optimize SCADA-to-OT data flows for improved visibility and control. Design SCADA security monitoring dashboards for operational visibility and threat detection. 4. OT Network Simulation & Testing Framework Develop a virtualized OT network environment for testing protocol translations and device communications. Simulate SCADA-to-PLC interactions within a cloud-based or hybrid testing framework. Create automated test cases for evaluating platform performance in large-scale OT environments. 5. AI-Driven Security & Network Optimization Contribute to AI-powered security heuristics for intrusion detection, anomaly recognition, and behavioral analysis. – Strongly Preferred Design real-time correlation engines to map network security events to operational risk indicators. Work with data scientists to integrate machine learning models for predictive network failure analysis. Required Skills & Qualifications: Networking & Industrial Protocols: Expertise in SNMP, LLDP, ARP-based discovery and industrial networking standards. Deep understanding of SCADA, PLC, DCS, and IIoT network architectures. Strong knowledge of Modbus TCP/IP, OPC-UA, EtherNet/IP, PROFINET. Security & Compliance: In-depth knowledge of IEC 62443, Zero Trust Architecture (ZTA), and industrial cybersecurity. Experience in firewall configurations, network segmentation, and encrypted communications (TLS 1.3, AES-256). Understanding of SIEM integration and OT security monitoring tools (Claroty, Nozomi, Dragos, CyberX). Platform Development & Integration: Experience in building scalable network discovery and security platforms for industrial automation. Familiarity with cloud-based OT security solutions (Azure Defender for IoT, AWS IoT Device Defender). Ability to work with RESTful APIs, MQTT, Kafka, and real-time event processing frameworks. Tools & Technologies: Network Security & Monitoring: Wireshark, Nmap, Zeek, Snort, Suricata. OT Security Platforms: Claroty, Nozomi Networks, Dragos, CyberX. Cloud & Edge Security: Azure IoT Hub, AWS IoT Core, Google Cloud IoT. PLC & SCADA Systems: Siemens, Rockwell, ABB, Schneider Electric, GE. Cloud & Edge Security: Azure Defender for IoT, AWS IoT Device Defender. Show more Show less

Do you like working on identifying and preventing potential cybersecurity risks? Are you ready for the next step in your career? Join our Digital Technology Team! Our Digital Technology business provides intelligent, connected technologies to monitor and control our energy extraction assets. We provide customers with the peace of mind needed to reliably and efficiently improve their operations. Our team creates business value through continuous improvement in up-time, resilience, performance, time to market, security and compliance Partner with the best As an Incident Response Analyst you will play a crucial role in safeguarding Baker Hughes information systems by analyzing a wide range of cybersecurity events. Your primary focus will be on identifying, investigating, and interpreting security incidents and trends, and making recommendations on appropriate containment and remediation steps. You will be at the forefront of detecting potential threats and vulnerabilities, providing critical insights that drive our cybersecurity defense strategies. As a Incident Response Analyst you will be Responsible for : Leading technical aspects of digital security incident detection and response, focusing on very unstructured incidents and high-risk events. Specializing in network-centric analysis (NSM), host-centric analysis (live response, digital forensics), malware analysis, and/or log-centric analysis (SIEM) Performing daily response operations with a schedule that may involve nontraditional working hours - act as escalation points for Event Triage Analysts Mentoring and train Event Analysts as required. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Fuel your passion Bachelor's Degree in Computer Science or “STEM” Majors (Science, Technology, Engineering and Math). A minimum 4 years of professional experience in STEM related degree, Political Science/Government/International Affairs. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Strong verbal and written communication skills Detailed understanding of APT, Cyber Crime and other associated tactics Strong track record of understanding and interest in recognized IT and OT security-related standards and technologies, demonstrated through training, job experience and/or industry Knowledge of and/or working on Baker Hughes OT products Professional experience with Cyber Security, Operations Security, Product Security, Industrial Control Systems (ICS), Information Assurance, and Information Technology Experience with host based detection and prevention suites (Microsoft Defender, OSSEC, Yara, MIR, Carbon Black, Tanium, etc.) Experience with host-centric tools for forensic collection and analysis (Microsoft Defender, Sleuth Kit, Volatility Framework, FTK, Encase, etc.) Experience with Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) and analysis techniques (alert, flow/session and PCAP analysis) Experience with malware and reverse engineering (Dynamic and static analysis) Strong IT infrastructure background including familiarity with the following: Networking (TCP/IP, UDP, Routing) Applications (HTTP, SMTP, DNS, FTP, SSH, etc.) Encryption (DES, AES, RSA) and hashing algorithms (MD5, SHA-1, etc.) System/Application vulnerabilities and exploitation Operating systems (Windows, *Nix, and Mac) Cloud technology (SaaS, IaaS, PaaS) and associated digital forensics and incident response techniques CISSP, CISM or related SANs certifications preferred Active US government security clearance Working knowledge of secure communication methods, including Secure Shell, S/MIME and PGP/GPG Work in a way that works for you We recognize that everyone is different and that the way in which people want to work and deliver at their best is different for everyone too. In this role, we can offer the following flexible working patterns: Working flexible hours - flexing the times when you work in the day to help you fit everything in and work when you are the most productive. Occasionally working remotely from home or any other work location Working with us Our people are at the heart of what we do at Baker Hughes. We know we are better when all of our people are developed, engaged and able to bring their whole authentic selves to work. We invest in the health and well-being of our workforce, train and reward talent and develop leaders at all levels to bring out the best in each other. Working for you Our inventions have revolutionized energy for over a century. But to keep going forward tomorrow, we know we have to push the boundaries today. We prioritize rewarding those who embrace change with a package that reflects how much we value their input. Join us, and you can expect: Contemporary work-life balance policies and wellbeing activities Comprehensive private medical care options Safety net of life insurance and disability programs Tailored financial programs Additional elected or voluntary benefits About Us: We are an energy technology company that provides solutions to energy and industrial customers worldwide. Built on a century of experience and conducting business in over 120 countries, our innovative technologies and services are taking energy forward – making it safer, cleaner and more efficient for people and the planet. Join Us: Are you seeking an opportunity to make a real difference in a company that values innovation and progress? Join us and become part of a team of people who will challenge and inspire you! Let’s come together and take energy forward. Baker Hughes Company is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law. R147718 Show more Show less

Do you like working on identifying and preventing potential cybersecurity risks? Are you ready for the next step in your career? Join our Digital Technology Team! Our Digital Technology business provides intelligent, connected technologies to monitor and control our energy extraction assets. We provide customers with the peace of mind needed to reliably and efficiently improve their operations. Our team creates business value through continuous improvement in up-time, resilience, performance, time to market, security and compliance Partner with the best As an Incident Response Analyst you will play a crucial role in safeguarding Baker Hughes information systems by analyzing a wide range of cybersecurity events. Your primary focus will be on identifying, investigating, and interpreting security incidents and trends, and making recommendations on appropriate containment and remediation steps. You will be at the forefront of detecting potential threats and vulnerabilities, providing critical insights that drive our cybersecurity defense strategies. As a Incident Response Analyst you will be Responsible for : Leading technical aspects of digital security incident detection and response, focusing on very unstructured incidents and high-risk events. Specializing in network-centric analysis (NSM), host-centric analysis (live response, digital forensics), malware analysis, and/or log-centric analysis (SIEM) Performing daily response operations with a schedule that may involve nontraditional working hours - act as escalation points for Event Triage Analysts Mentoring and train Event Analysts as required. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Fuel your passion Bachelor's Degree in Computer Science or “STEM” Majors (Science, Technology, Engineering and Math). A minimum 4 years of professional experience in STEM related degree, Political Science/Government/International Affairs. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Strong verbal and written communication skills Detailed understanding of APT, Cyber Crime and other associated tactics Strong track record of understanding and interest in recognized IT and OT security-related standards and technologies, demonstrated through training, job experience and/or industry Knowledge of and/or working on Baker Hughes OT products Professional experience with Cyber Security, Operations Security, Product Security, Industrial Control Systems (ICS), Information Assurance, and Information Technology Experience with host based detection and prevention suites (Microsoft Defender, OSSEC, Yara, MIR, Carbon Black, Tanium, etc.) Experience with host-centric tools for forensic collection and analysis (Microsoft Defender, Sleuth Kit, Volatility Framework, FTK, Encase, etc.) Experience with Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) and analysis techniques (alert, flow/session and PCAP analysis) Experience with malware and reverse engineering (Dynamic and static analysis) Strong IT infrastructure background including familiarity with the following: Networking (TCP/IP, UDP, Routing) Applications (HTTP, SMTP, DNS, FTP, SSH, etc.) Encryption (DES, AES, RSA) and hashing algorithms (MD5, SHA-1, etc.) System/Application vulnerabilities and exploitation Operating systems (Windows, *Nix, and Mac) Cloud technology (SaaS, IaaS, PaaS) and associated digital forensics and incident response techniques CISSP, CISM or related SANs certifications preferred Active US government security clearance Working knowledge of secure communication methods, including Secure Shell, S/MIME and PGP/GPG Work in a way that works for you We recognize that everyone is different and that the way in which people want to work and deliver at their best is different for everyone too. In this role, we can offer the following flexible working patterns: Working flexible hours - flexing the times when you work in the day to help you fit everything in and work when you are the most productive. Occasionally working remotely from home or any other work location Working with us Our people are at the heart of what we do at Baker Hughes. We know we are better when all of our people are developed, engaged and able to bring their whole authentic selves to work. We invest in the health and well-being of our workforce, train and reward talent and develop leaders at all levels to bring out the best in each other. Working for you Our inventions have revolutionized energy for over a century. But to keep going forward tomorrow, we know we have to push the boundaries today. We prioritize rewarding those who embrace change with a package that reflects how much we value their input. Join us, and you can expect: Contemporary work-life balance policies and wellbeing activities Comprehensive private medical care options Safety net of life insurance and disability programs Tailored financial programs Additional elected or voluntary benefits About Us: We are an energy technology company that provides solutions to energy and industrial customers worldwide. Built on a century of experience and conducting business in over 120 countries, our innovative technologies and services are taking energy forward – making it safer, cleaner and more efficient for people and the planet. Join Us: Are you seeking an opportunity to make a real difference in a company that values innovation and progress? Join us and become part of a team of people who will challenge and inspire you! Let’s come together and take energy forward. Baker Hughes Company is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law. R147718 Show more Show less

Do you like working on identifying and preventing potential cybersecurity risks? Are you ready for the next step in your career? Join our Digital Technology Team! Our Digital Technology business provides intelligent, connected technologies to monitor and control our energy extraction assets. We provide customers with the peace of mind needed to reliably and efficiently improve their operations. Our team creates business value through continuous improvement in up-time, resilience, performance, time to market, security and compliance Partner with the best As an Incident Response Analyst you will play a crucial role in safeguarding Baker Hughes information systems by analyzing a wide range of cybersecurity events. Your primary focus will be on identifying, investigating, and interpreting security incidents and trends, and making recommendations on appropriate containment and remediation steps. You will be at the forefront of detecting potential threats and vulnerabilities, providing critical insights that drive our cybersecurity defense strategies. As a Incident Response Analyst you will be Responsible for : Leading technical aspects of digital security incident detection and response, focusing on very unstructured incidents and high-risk events. Specializing in network-centric analysis (NSM), host-centric analysis (live response, digital forensics), malware analysis, and/or log-centric analysis (SIEM) Performing daily response operations with a schedule that may involve nontraditional working hours - act as escalation points for Event Triage Analysts Mentoring and train Event Analysts as required. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Fuel your passion Bachelor's Degree in Computer Science or “STEM” Majors (Science, Technology, Engineering and Math). A minimum 4 years of professional experience in STEM related degree, Political Science/Government/International Affairs. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Strong verbal and written communication skills Detailed understanding of APT, Cyber Crime and other associated tactics Strong track record of understanding and interest in recognized IT and OT security-related standards and technologies, demonstrated through training, job experience and/or industry Knowledge of and/or working on Baker Hughes OT products Professional experience with Cyber Security, Operations Security, Product Security, Industrial Control Systems (ICS), Information Assurance, and Information Technology Experience with host based detection and prevention suites (Microsoft Defender, OSSEC, Yara, MIR, Carbon Black, Tanium, etc.) Experience with host-centric tools for forensic collection and analysis (Microsoft Defender, Sleuth Kit, Volatility Framework, FTK, Encase, etc.) Experience with Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) and analysis techniques (alert, flow/session and PCAP analysis) Experience with malware and reverse engineering (Dynamic and static analysis) Strong IT infrastructure background including familiarity with the following: Networking (TCP/IP, UDP, Routing) Applications (HTTP, SMTP, DNS, FTP, SSH, etc.) Encryption (DES, AES, RSA) and hashing algorithms (MD5, SHA-1, etc.) System/Application vulnerabilities and exploitation Operating systems (Windows, *Nix, and Mac) Cloud technology (SaaS, IaaS, PaaS) and associated digital forensics and incident response techniques CISSP, CISM or related SANs certifications preferred Active US government security clearance Working knowledge of secure communication methods, including Secure Shell, S/MIME and PGP/GPG Work in a way that works for you We recognize that everyone is different and that the way in which people want to work and deliver at their best is different for everyone too. In this role, we can offer the following flexible working patterns: Working flexible hours - flexing the times when you work in the day to help you fit everything in and work when you are the most productive. Occasionally working remotely from home or any other work location Working with us Our people are at the heart of what we do at Baker Hughes. We know we are better when all of our people are developed, engaged and able to bring their whole authentic selves to work. We invest in the health and well-being of our workforce, train and reward talent and develop leaders at all levels to bring out the best in each other. Working for you Our inventions have revolutionized energy for over a century. But to keep going forward tomorrow, we know we have to push the boundaries today. We prioritize rewarding those who embrace change with a package that reflects how much we value their input. Join us, and you can expect: Contemporary work-life balance policies and wellbeing activities Comprehensive private medical care options Safety net of life insurance and disability programs Tailored financial programs Additional elected or voluntary benefits About Us: We are an energy technology company that provides solutions to energy and industrial customers worldwide. Built on a century of experience and conducting business in over 120 countries, our innovative technologies and services are taking energy forward – making it safer, cleaner and more efficient for people and the planet. Join Us: Are you seeking an opportunity to make a real difference in a company that values innovation and progress? Join us and become part of a team of people who will challenge and inspire you! Let’s come together and take energy forward. Baker Hughes Company is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law. R147718 Show more Show less

Do you like working on identifying and preventing potential cybersecurity risks? Are you ready for the next step in your career? Join our Digital Technology Team! Our Digital Technology business provides intelligent, connected technologies to monitor and control our energy extraction assets. We provide customers with the peace of mind needed to reliably and efficiently improve their operations. Our team creates business value through continuous improvement in up-time, resilience, performance, time to market, security and compliance Partner with the best As an Incident Response Analyst you will play a crucial role in safeguarding Baker Hughes information systems by analyzing a wide range of cybersecurity events. Your primary focus will be on identifying, investigating, and interpreting security incidents and trends, and making recommendations on appropriate containment and remediation steps. You will be at the forefront of detecting potential threats and vulnerabilities, providing critical insights that drive our cybersecurity defense strategies. As a Incident Response Analyst you will be Responsible for : Leading technical aspects of digital security incident detection and response, focusing on very unstructured incidents and high-risk events. Specializing in network-centric analysis (NSM), host-centric analysis (live response, digital forensics), malware analysis, and/or log-centric analysis (SIEM) Performing daily response operations with a schedule that may involve nontraditional working hours - act as escalation points for Event Triage Analysts Mentoring and train Event Analysts as required. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Fuel your passion Bachelor's Degree in Computer Science or “STEM” Majors (Science, Technology, Engineering and Math). A minimum 4 years of professional experience in STEM related degree, Political Science/Government/International Affairs. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Strong verbal and written communication skills Detailed understanding of APT, Cyber Crime and other associated tactics Strong track record of understanding and interest in recognized IT and OT security-related standards and technologies, demonstrated through training, job experience and/or industry Knowledge of and/or working on Baker Hughes OT products Professional experience with Cyber Security, Operations Security, Product Security, Industrial Control Systems (ICS), Information Assurance, and Information Technology Experience with host based detection and prevention suites (Microsoft Defender, OSSEC, Yara, MIR, Carbon Black, Tanium, etc.) Experience with host-centric tools for forensic collection and analysis (Microsoft Defender, Sleuth Kit, Volatility Framework, FTK, Encase, etc.) Experience with Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) and analysis techniques (alert, flow/session and PCAP analysis) Experience with malware and reverse engineering (Dynamic and static analysis) Strong IT infrastructure background including familiarity with the following: Networking (TCP/IP, UDP, Routing) Applications (HTTP, SMTP, DNS, FTP, SSH, etc.) Encryption (DES, AES, RSA) and hashing algorithms (MD5, SHA-1, etc.) System/Application vulnerabilities and exploitation Operating systems (Windows, *Nix, and Mac) Cloud technology (SaaS, IaaS, PaaS) and associated digital forensics and incident response techniques CISSP, CISM or related SANs certifications preferred Active US government security clearance Working knowledge of secure communication methods, including Secure Shell, S/MIME and PGP/GPG Work in a way that works for you We recognize that everyone is different and that the way in which people want to work and deliver at their best is different for everyone too. In this role, we can offer the following flexible working patterns: Working flexible hours - flexing the times when you work in the day to help you fit everything in and work when you are the most productive. Occasionally working remotely from home or any other work location Working with us Our people are at the heart of what we do at Baker Hughes. We know we are better when all of our people are developed, engaged and able to bring their whole authentic selves to work. We invest in the health and well-being of our workforce, train and reward talent and develop leaders at all levels to bring out the best in each other. Working for you Our inventions have revolutionized energy for over a century. But to keep going forward tomorrow, we know we have to push the boundaries today. We prioritize rewarding those who embrace change with a package that reflects how much we value their input. Join us, and you can expect: Contemporary work-life balance policies and wellbeing activities Comprehensive private medical care options Safety net of life insurance and disability programs Tailored financial programs Additional elected or voluntary benefits About Us: We are an energy technology company that provides solutions to energy and industrial customers worldwide. Built on a century of experience and conducting business in over 120 countries, our innovative technologies and services are taking energy forward – making it safer, cleaner and more efficient for people and the planet. Join Us: Are you seeking an opportunity to make a real difference in a company that values innovation and progress? Join us and become part of a team of people who will challenge and inspire you! Let’s come together and take energy forward. Baker Hughes Company is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law. R147718 Show more Show less

Must have skills : Azure Sentinel L2/L3 SOC Analyst Preferred : HYD Exp : Minimum 6 yrs in security domain, and atleast 3 yrs as L2/L3 JD : .Develop and maintain playbooks runbooks and incident response procedures .Collaborate with threat intelligence teams to enrich alerts and improve detection capabilities .Conduct post incident reviews and root cause analysis .Mentor and train L1 and L2 SOC analysts .Recommend and implement improvements to SOC tools processes and detection rules .Stay current with emerging threats vulnerabilities and security technologies .The expectations from the graders would be .To evaluate the tasks that are being fed into the agent for their real world applicability .To evaluate the agent output to come up with a ground truth and rate the agent output in a .Predefined rubric based on the inputs provided by us .To have very deep SOC analyst experience and insights This also includes any other skills needed .T.o evaluate the agent output The ability to scale to around min 2030 evaluations per day per grader based on the complexity of the task. Core Technical Skills:- .SIEM Tools eg Splunk QRadar Microsoft Sentinel .Endpoint Detection and Response EDR eg CrowdStrike SentinelOne .Firewall and IDSIPS eg Palo Alto Snort Suricata .Log Analysis and Packet Capture Analysis eg Wireshark .Threat Intelligence Platforms eg MISP Recorded Future .Incident Response and Forensics .Scripting Automation Python PowerShell Bash .Operating Systems Windows Linux macOS .Networking Fundamentals TCPIP DNS HTTP VPNs Kindly share your CV at Ranjana.singh1@ltimindtree.com Regards Ranjana Singh Show more Show less

Req ID: 321051 NTT DATA strives to hire exceptional, innovative and passionate individuals who want to grow with us. If you want to be part of an inclusive, adaptable, and forward-thinking organization, apply now. We are currently seeking a Sol Architect - Network Security Advisor to join our team in Bangalore, Karnātaka (IN-KA), India (IN). Drive for results - Ability to grasp complex issues to arrive at optimal solutions - Strong ethics and integrity - Flexible to changing needs of customer , account and team - Excellent customer facing communication skills, customer support and knowledge of ITIL best practices. ITIL certification is a plus. - High-level experience and proved knowledge in Algosec tool and atleast 2 network security products likes Firewalls (Watchguard, Cisco, Palo Alto), Content Filtering (Cisco Umbrella, Bluecoats, Websense, McAfee Web gateway) and IDS/IPS (Cisco Sourcefire, McAfee, Tipping Point, Snort) - Strong working knowledge of Algosec. - High-level networking troubleshooting skills and extensive knowledge of web connectivity and protocols (WCCP, PAC files, TCP/IP, HTTP, HTTPS, SSL, FTP, Telnet, SSH, etc.) - Understanding the integration with authentication protocols such as LDAP, IWA, IWA-direct, SSO, Active directory. - Candidate must possess good time management skills to properly manage operations duties and other task that will assist in the optimization of the Network Security team - Clear understanding of Windows and Linux operating systems - 8+ years of network troubleshooting experience and at least 4-5 years Network Security administration and design experience - Bachelor's degree or equivalent experience. About NTT DATA NTT DATA is a $30 billion trusted global innovator of business and technology services. We serve 75% of the Fortune Global 100 and are committed to helping clients innovate, optimize and transform for long term success. As a Global Top Employer, we have diverse experts in more than 50 countries and a robust partner ecosystem of established and start-up companies. Our services include business and technology consulting, data and artificial intelligence, industry solutions, as well as the development, implementation and management of applications, infrastructure and connectivity. We are one of the leading providers of digital and AI infrastructure in the world. NTT DATA is a part of NTT Group, which invests over $3.6 billion each year in R&D to help organizations and society move confidently and sustainably into the digital future. Visit us at us.nttdata.com NTT DATA endeavors to make https://us.nttdata.com accessible to any and all users. If you would like to contact us regarding the accessibility of our website or need assistance completing the application process, please contact us at https://us.nttdata.com/en/contact-us. This contact information is for accommodation requests only and cannot be used to inquire about the status of applications. NTT DATA is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status. For our EEO Policy Statement, please click here. If you'd like more information on your EEO rights under the law, please click here. For Pay Transparency information, please click here.

About the job Company Name: Helix Tech INC Job Title : Cyber Security / Networking Technical Expert Company Website: https://helixtechinc.com/ Location: Ahmedabad, Gujarat Shift: US Shift (Night Shift) Working Days: 5 Days working (Monday to Friday) Work From Office Only Requirements: Prepare the Candidates to crack Interviews with fortune 500 companies, help to improve their technical skills and mentor them, also evaluate them to identify areas for improvement. Conduct training and development assessment of candidates for different tools and technologies with real-time projects. Develops training and development programs and objectives. Obtains and /or develops effective training materials utilising a variety of media. Coordinate with candidates to provide the skills and knowledge in different tools and technologies. Create Plans, organise, and facilitate training for candidate development and training sessions. Required Skills: Bachelor’s degree in computer science, software engineering, or a similar field. Advanced knowledge of Cybersecurity technologies 3+ years of work experience in the above-mentioned area Experience in IT Project Management is a plus Knowledge of network technologies (Network, Firewall architecture) and Server operating systems Networking Protocols: TCP/IP, IPv4, VPN, HTTP, DNS, LAN/WAN, OSPF, BGP Security Tools: Nmap, Snort, TCPDUMP, Nessus, Wireshark, Core Impact, OpenVAS, HIDS/HIPS, SIEM, Active Directory, IDS, IPS, DNS, DHCP, Splunk, Burp suite, OWASP, SIM Tools, Vulnerability Scanning Job Types: Full-time, Permanent, Fresher, Internship Pay: ₹18,086.00 - ₹32,727.29 per month Benefits: Internet reimbursement Paid sick time Schedule: Fixed shift Monday to Friday Night shift US shift Supplemental Pay: Overtime pay Performance bonus Quarterly bonus Work Location: In person

The Security Engineer is responsible for designing, implementing, and maintaining security across all products and infrastructure, with a focus on both blockchain/wallet and general application security. This role requires a strategic mindset, strong risk management skills, and the ability to communicate security concepts to both technical and non-technical stakeholders. The ideal candidate is proactive, detail-oriented, and committed to fostering a culture of security throughout the organization. Responsibilities Develop and enforce security policies, standards and best practices. Lead security architecture reviews and risk assessments. Collaborate with engineering, product, and operations teams to ensure secure design and implementation. Oversee incident response, forensics, and post-incident analysis. Conduct security awareness training and promote a security-first culture. Stay current with emerging threats, vulnerabilities, and security technologies. Ensure compliance with relevant regulations and industry standards. Coordinate with external auditors, partners, and vendors on security matters. Qualifications and Experience Bachelors degree in Computer Science, Information Security, or related field (or equivalent experience). Relevant security certifications (CISSP, CISM, CEH, OSCP, etc.). 5+ years of experience in security engineering or related roles. Demonstrated experience with both blockchain and traditional application/infrastructure security. Experience leading security initiatives and incident response. Deep understanding of security frameworks, standards, and regulations (NIST, ISO 27001, GDPR, etc.). Awareness of current threat landscape and security technologies. Familiarity with blockchain security and smart contract vulnerabilities.

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

At EY, you’ll have the chance to build a career as unique as you are, with the global scale, support, inclusive culture and technology to become the best version of you. And we’re counting on your unique voice and perspective to help EY become even better, too. Join us and build an exceptional experience for yourself, and a better working world for all. Role Overview: We are seeking a highly skilled Senior Cyber Threat Intelligence Analyst to join the Canada CTI team. The role involves collecting, analyzing, and disseminating actionable intelligence to support cybersecurity operations and protect the organization against emerging threats. The candidate will collaborate with internal and external stakeholders, conduct threat research, and contribute to the development of intelligence-driven strategies. Responsibilities: Lead the monitoring and analysis of emerging cyber threats across various sectors (e.g., Finance, Healthcare, Education). Perform in-depth analysis of advanced threat actor campaigns, including TTPs (Tactics, Techniques, and Procedures), and translate findings into actionable intelligence. Develop and maintain a comprehensive repository of cyber threat data for risk assessment and trend analysis. Create and present detailed reports (Strategic, Tactical, and Operational) to stakeholders, ensuring technical findings are communicated effectively. Develop and document threat intelligence playbooks and procedures. Identify and improve security detection capabilities using YARA, SIGMA, Snort, and similar rulesets. Collaborate with cross-functional teams to assess risks and recommend mitigation strategies. Evaluate and refine alerts triggered by threat intelligence platforms. Use OSINT techniques to validate and prioritize alerts and escalate critical threats promptly. Work closely with international IT teams and third-party vendors to understand adversary intent and activity. Stay informed about the latest cybersecurity trends, vulnerabilities, and attack methodologies. Contribute to the design and enhancement of the organization's Threat Intelligence Program. Participates in the assessment, analysis, and design of improvements for the Threat Intelligence Program. Perform as-hoc intelligence gathering using OSINT tools and techniques Able to apply creative and critical thinking when approaching issues. Required Qualifications: Bachelor's degree in Computer Science or equivalent, with a certification such as GCTI (GIAC Cyber Threat Intelligence). Extensive experience with threat intelligence platforms and playbook development. Proficiency in tools like MITRE ATT&CK, Diamond Model, and Cyber Kill Chain frameworks. Strong analytical skills and expertise in OSINT techniques. Advanced knowledge of cybersecurity incidents, attack vectors, and threat actor behaviour. Familiarity with Python, APIs, Docker containers, and automation tools. Proven ability to work independently and handle complex situations. Excellent verbal and written communication skills to deliver briefings to diverse audiences. Additional Information: This position requires support during Canada business hours. EY | Building a better working world EY exists to build a better working world, helping to create long-term value for clients, people and society and build trust in the capital markets. Enabled by data and technology, diverse EY teams in over 150 countries provide trust through assurance and help clients grow, transform and operate. Working across assurance, consulting, law, strategy, tax and transactions, EY teams ask better questions to find new answers for the complex issues facing our world today. Show more Show less

Cybersecurity Analyst Intern Company: INLIGHN TECH Location: Remote (100% Virtual) Duration: 3 Months Stipend for Top Interns: ₹15,000 Certificate Provided | Letter of Recommendation | Full-Time Offer Based on Performance About the Company: INLIGHN TECH empowers students and fresh graduates with real-world experience through hands-on, project-driven internships. The Cybersecurity Analyst Internship is tailored to develop your expertise in identifying and mitigating cyber threats while gaining practical knowledge of modern security tools and frameworks. Role Overview: As a Cybersecurity Analyst Intern, you will work on monitoring networks, analyzing threats, and helping ensure the security of digital infrastructure. This internship will deepen your understanding of incident response, threat intelligence, and proactive defense strategies in a real-world context. Key Responsibilities: Monitor security systems and analyze logs for suspicious activity Conduct vulnerability assessments and recommend remediation steps Assist in security audits and compliance checks Perform malware analysis and track threat actors using threat intelligence platforms Document security incidents and prepare reports on findings Support the implementation of cybersecurity best practices and policies Qualifications: Pursuing or recently completed a degree in Cybersecurity, Information Security, Computer Science, or a related field Strong understanding of network protocols, firewalls, and endpoint protection Familiarity with security tools such as Wireshark, Snort, Nessus, or Splunk Awareness of cybersecurity frameworks (e.g., MITRE ATT&CK, NIST) Good problem-solving and analytical thinking skills Eagerness to learn, investigate, and defend against cyber threats Internship Benefits: Hands-on experience with cybersecurity tools and threat detection methods Certificate of Internship upon successful completion Letter of Recommendation for top performers Build a strong portfolio of cybersecurity analysis and incident response case studies Show more Show less

Cybersecurity Analyst Intern Company: INLIGHN TECH Location: Remote (100% Virtual) Duration: 3 Months Stipend for Top Interns: ₹15,000 Certificate Provided | Letter of Recommendation | Full-Time Offer Based on Performance About the Company: INLIGHN TECH empowers students and fresh graduates with real-world experience through hands-on, project-driven internships. The Cybersecurity Analyst Internship is tailored to develop your expertise in identifying and mitigating cyber threats while gaining practical knowledge of modern security tools and frameworks. Role Overview: As a Cybersecurity Analyst Intern, you will work on monitoring networks, analyzing threats, and helping ensure the security of digital infrastructure. This internship will deepen your understanding of incident response, threat intelligence, and proactive defense strategies in a real-world context. Key Responsibilities: Monitor security systems and analyze logs for suspicious activity Conduct vulnerability assessments and recommend remediation steps Assist in security audits and compliance checks Perform malware analysis and track threat actors using threat intelligence platforms Document security incidents and prepare reports on findings Support the implementation of cybersecurity best practices and policies Qualifications: Pursuing or recently completed a degree in Cybersecurity, Information Security, Computer Science, or a related field Strong understanding of network protocols, firewalls, and endpoint protection Familiarity with security tools such as Wireshark, Snort, Nessus, or Splunk Awareness of cybersecurity frameworks (e.g., MITRE ATT&CK, NIST) Good problem-solving and analytical thinking skills Eagerness to learn, investigate, and defend against cyber threats Internship Benefits: Hands-on experience with cybersecurity tools and threat detection methods Certificate of Internship upon successful completion Letter of Recommendation for top performers Build a strong portfolio of cybersecurity analysis and incident response case studies Show more Show less

Cybersecurity Analyst Intern Company: INLIGHN TECH Location: Remote (100% Virtual) Duration: 3 Months Stipend for Top Interns: ₹15,000 Certificate Provided | Letter of Recommendation | Full-Time Offer Based on Performance About the Company: INLIGHN TECH empowers students and fresh graduates with real-world experience through hands-on, project-driven internships. The Cybersecurity Analyst Internship is tailored to develop your expertise in identifying and mitigating cyber threats while gaining practical knowledge of modern security tools and frameworks. Role Overview: As a Cybersecurity Analyst Intern, you will work on monitoring networks, analyzing threats, and helping ensure the security of digital infrastructure. This internship will deepen your understanding of incident response, threat intelligence, and proactive defense strategies in a real-world context. Key Responsibilities: Monitor security systems and analyze logs for suspicious activity Conduct vulnerability assessments and recommend remediation steps Assist in security audits and compliance checks Perform malware analysis and track threat actors using threat intelligence platforms Document security incidents and prepare reports on findings Support the implementation of cybersecurity best practices and policies Qualifications: Pursuing or recently completed a degree in Cybersecurity, Information Security, Computer Science, or a related field Strong understanding of network protocols, firewalls, and endpoint protection Familiarity with security tools such as Wireshark, Snort, Nessus, or Splunk Awareness of cybersecurity frameworks (e.g., MITRE ATT&CK, NIST) Good problem-solving and analytical thinking skills Eagerness to learn, investigate, and defend against cyber threats Internship Benefits: Hands-on experience with cybersecurity tools and threat detection methods Certificate of Internship upon successful completion Letter of Recommendation for top performers Build a strong portfolio of cybersecurity analysis and incident response case studies Show more Show less

Location Mumbai, Maharashtra, India Category Digital Technology Job ID: R147718 Posted: May 21st 2025 Job Available In 5 Locations Incident Response Analyst Do you like working on identifying and preventing potential cybersecurity risks? Are you ready for the next step in your career? Join our Digital Technology Team! Our Digital Technology business provides intelligent, connected technologies to monitor and control our energy extraction assets. We provide customers with the peace of mind needed to reliably and efficiently improve their operations. Our team creates business value through continuous improvement in up-time, resilience, performance, time to market, security and compliance Partner with the best As an Incident Response Analyst you will play a crucial role in safeguarding Baker Hughes information systems by analyzing a wide range of cybersecurity events. Your primary focus will be on identifying, investigating, and interpreting security incidents and trends, and making recommendations on appropriate containment and remediation steps. You will be at the forefront of detecting potential threats and vulnerabilities, providing critical insights that drive our cybersecurity defense strategies. As a Incident Response Analyst you will be Responsible for : Leading technical aspects of digital security incident detection and response, focusing on very unstructured incidents and high-risk events. Specializing in network-centric analysis (NSM), host-centric analysis (live response, digital forensics), malware analysis, and/or log-centric analysis (SIEM) Performing daily response operations with a schedule that may involve nontraditional working hours - act as escalation points for Event Triage Analysts Mentoring and train Event Analysts as required. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Fuel your passion Bachelor's Degree in Computer Science or “STEM” Majors (Science, Technology, Engineering and Math). A minimum 4 years of professional experience in STEM related degree, Political Science/Government/International Affairs. The best candidates for the role work well with other people and have strong verbal and written communication skills, a sense of diplomacy, and decision making skills to handle the often fast-paced role of an incident handler Strong verbal and written communication skills Detailed understanding of APT, Cyber Crime and other associated tactics Strong track record of understanding and interest in recognized IT and OT security-related standards and technologies, demonstrated through training, job experience and/or industry Knowledge of and/or working on Baker Hughes OT products Professional experience with Cyber Security, Operations Security, Product Security, Industrial Control Systems (ICS), Information Assurance, and Information Technology Experience with host based detection and prevention suites (Microsoft Defender, OSSEC, Yara, MIR, Carbon Black, Tanium, etc.) Experience with host-centric tools for forensic collection and analysis (Microsoft Defender, Sleuth Kit, Volatility Framework, FTK, Encase, etc.) Experience with Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) and analysis techniques (alert, flow/session and PCAP analysis) Experience with malware and reverse engineering (Dynamic and static analysis) Strong IT infrastructure background including familiarity with the following: Networking (TCP/IP, UDP, Routing) Applications (HTTP, SMTP, DNS, FTP, SSH, etc.) Encryption (DES, AES, RSA) and hashing algorithms (MD5, SHA-1, etc.) System/Application vulnerabilities and exploitation Operating systems (Windows, *Nix, and Mac) Cloud technology (SaaS, IaaS, PaaS) and associated digital forensics and incident response techniques CISSP, CISM or related SANs certifications preferred Active US government security clearance Working knowledge of secure communication methods, including Secure Shell, S/MIME and PGP/GPG Work in a way that works for you We recognize that everyone is different and that the way in which people want to work and deliver at their best is different for everyone too. In this role, we can offer the following flexible working patterns: Working flexible hours - flexing the times when you work in the day to help you fit everything in and work when you are the most productive. Occasionally working remotely from home or any other work location Working with us Our people are at the heart of what we do at Baker Hughes. We know we are better when all of our people are developed, engaged and able to bring their whole authentic selves to work. We invest in the health and well-being of our workforce, train and reward talent and develop leaders at all levels to bring out the best in each other. Working for you Our inventions have revolutionized energy for over a century. But to keep going forward tomorrow, we know we have to push the boundaries today. We prioritize rewarding those who embrace change with a package that reflects how much we value their input. Join us, and you can expect: Contemporary work-life balance policies and wellbeing activities Comprehensive private medical care options Safety net of life insurance and disability programs Tailored financial programs Additional elected or voluntary benefits About Us: We are an energy technology company that provides solutions to energy and industrial customers worldwide. Built on a century of experience and conducting business in over 120 countries, our innovative technologies and services are taking energy forward – making it safer, cleaner and more efficient for people and the planet. Join Us: Are you seeking an opportunity to make a real difference in a company that values innovation and progress? Join us and become part of a team of people who will challenge and inspire you! Let’s come together and take energy forward. Baker Hughes Company is an Equal Opportunity Employer. Employment decisions are made without regard to race, color, religion, national or ethnic origin, sex, sexual orientation, gender identity or expression, age, disability, protected veteran status or other characteristics protected by law.

Cybersecurity Intern Company: INLIGHN TECH Location: Remote (100% Virtual) Duration: 3 Months Stipend for Top Interns: ₹15,000 Certificate Provided | LOR | Potential Full-Time Offer Based on Performance About the Company: INLIGHN TECH aims to bridge the gap between academic learning and industry demands by providing hands-on, project-based internships. Our Cybersecurity Internship offers aspiring professionals the chance to work on real security projects, gaining vital experience in threat detection, incident response, and secure system design. Role Overview: As a Cybersecurity Intern, you will work with our security team to monitor systems, identify vulnerabilities, and assist in strengthening our digital infrastructure. This role is designed to build your foundational knowledge of cybersecurity practices and tools through practical application. Key Responsibilities: Monitor network and system security for unusual activity or threats Conduct vulnerability assessments and assist in patch management Use tools such as Wireshark , Kali Linux , Nmap , and Snort for analysis Help in investigating security breaches and preparing incident reports Research current cyber threats, malware, and attack vectors Contribute to documentation of security policies, protocols, and best practices Qualifications: Currently pursuing or recently completed a degree in Cybersecurity , Information Technology , Computer Science , or a related field Familiarity with network security concepts , firewalls , and intrusion detection systems Basic experience with tools like Nmap , Wireshark , Kali Linux , etc. Understanding of threat modeling and security principles Strong analytical thinking, attention to detail, and eagerness to learn Internship Benefits: Real-world exposure to cybersecurity frameworks and tools Certificate of Internship on successful completion Letter of Recommendation for outstanding performance Build a portfolio of security projects and reports Potential stipend and full-time job offer for top performers Show more Show less

The Sr. QA Analyst will provide deep level analysis for client investigations utilizing customer provided data sources, audit, and monitoring tools at both the government and enterprise level. The Sr. Threat Analyst will work closely with our Technology Engineers, Architects, and Threat Analysts to service customers. How You’ll Make An Impact High level professional writing experience regarding documenting and reporting on potential security incidents identified in customer environments to include timeline of events. Work with partners to maintain an understanding of security threats, vulnerabilities, and exploits that could impact systems, networks, and assets. Provide analysis on various security enforcement technologies including, but not limited to SIEM, anti-virus, content filtering/reporting, malware prevention, firewalls, intrusion detection systems, web application firewalls, messaging security platforms, vulnerability scanners etc. Perform knowledge transfers, document, and train clients regarding mitigation of identified threats. Provide ongoing recommendations to peers and customers on tuning and best practices. Actively research current threats and attack vectors being exploited in the wild Actively work with analysts and perform investigations on escalations. Ability to discuss security posture with multiple clients and make recommendations to better their holistic security approach. Provide gap analysis for clients to better their security posture. Maintain and develop SOPs for threat analyst team. Develop and maintain Playbooks and runbooks. Work with internal teams to increase efficiency and effectiveness of security analysis provided by the threat analysis team. Training of new analysts on security and tools Create and maintain Content Catalog based on security essentials and the evolving threat landscape. Provide quality assurance (QA) review of security alerts handled by Team members. Conduct regular security audits to ensure compliance with industry standards and regulations. Evaluate security controls, policies, and procedures. Identify vulnerabilities and enhance remediation actions. What We’re Looking For Five years of full-time professional experience in the Information Security field Experience working in a Security Operations Center (SOC), Managed Security Service (MSS), or enterprise network environment as a point of escalation. Excellent time management, reporting, and communication skills including customer interactions and executive presentations. Data analysis using SIEM, Database tools, and Excel. Experience troubleshooting security devices and SIEM. Ability to create and maintain content within SIEM environments and make recommendations to clients to better their visibility. IDS monitoring/analysis with tools such as Sourcefire and Snort Experience with SIEM platforms preferred (QRadar, LogRhythm, McAfee/Nitro, ArcSight, Splunk) a plus. Experience with audit tools, MS office, Power BI Knowledge of security information and event management (SIEM) systems. Understanding of cloud security and virtualization. Direct (E.g., SQL Injection) versus indirect (E.g., cross-site scripting) attacks Experience with the following attacks: Web Based Attacks and the OWASP Top 10, Network Based DoS, Brute force, HTTP Based DoS, Denial of Service, Network Based / System Based Attacks. Familiarity with SANS top 20 critical security controls Understand the foundations of enterprise Windows security including Active Directory, Windows security architecture and terminology, Privilege escalation techniques, Common mitigation controls and system hardening. Anti-Virus (AV) and Host Based Intrusion Prevention (HIPS) Experience in monitoring at least one commercial AV solution such as (but not limited to) McAfee/Intel, Symantec, Sophos, or Trend Micro Ability to identify common false positives and make suggestions on tuning. Understanding of root causes of malware and proactive mitigation Propagation of malware in enterprise environments Familiarity with web-based exploit kits and the methods employed by web-based exploit kits. Familiarity with concepts associated with Advanced Persistent Threats and “targeted malware.” Experience and understanding of malware protection tools (FireEye) and controls in an enterprise environment. Covert channels, egress, and data exfiltration techniques Familiarity with vulnerability scoring systems such as CVSS. Basic understanding of vulnerability assessment tools such as vulnerability scanners and exploitation frameworks This team provides 24/7 support. This role requires shift flexibility, including the ability to rotate between days, mids, and nights. What You Can Expect From Optiv A company committed to championing Diversity, Equality, and Inclusion through our Employee Resource Groups. Work/life balance Professional training resources Creative problem-solving and the ability to tackle unique, complex projects Volunteer Opportunities. “Optiv Chips In” encourages employees to volunteer and engage with their teams and communities. The ability and technology necessary to productively work remotely/from home (where applicable) EEO Statement Optiv is an equal opportunity employer (EEO). All qualified applicants for employment will be considered without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, status as an individual with a disability, veteran status, or any other basis protected by federal, state, or local law. Optiv respects your privacy. By providing your information through this page or applying for a job at Optiv, you acknowledge that Optiv will collect, use, and process your information, which may include personal information and sensitive personal information, in connection with Optiv’s selection and recruitment activities. For additional details on how Optiv uses and protects your personal information in the application process, click here to view our Applicant Privacy Notice. If you sign up to receive notifications of job postings, you may unsubscribe at any time. Show more Show less