Who We Are

The SBG Security Operations Team detects and defends against adversarial events in SBG (Security Business Group) computing environments through strategic vulnerability management, threat detection, and incident response disciplines. We are part of a larger SBG Product Assurance organization whose mission is to Instill confidence in our engineering customers and leaders that SBG offers and products are delivered to the world securely.

What You’ll Do

The SBG Security Operations Team is seeking an experienced candidate to serve as a Cyber Threat Analyst. The successful candidate is proficient in numerous security technologies, understands the motivations and capabilities of sophisticated threat actors and can communicate risks and make recommendations associated with specific network threats. The Cyber Threat Analyst will conduct threat intelligence research and hunt operations for threat indicators discovered in intelligence or within security incidents shared by partner analysts.

Roles and Responsibilities:

• Actively researching new TTPs from public and internal reporting
• Develop and maintain a library of ad-hoc threat hunts for other teams to use daily
• Applying the output of threat hunts are into new detections and gap assessment
• Demonstrate expertise by uncovering adversary activity not detected by our current detection rules
• Review and analyze security data within the SIEM and network traffic such as full packet captures and/or Netflow data to detect traffic anomalies, identify infected systems and threat actor related activity based on known tactics, techniques, and procedures.
• Monitor various security blogs, alerts and notifications, RSS feeds and forums to keep abreast of the latest security news, attacks, threats, vulnerabilities and exploits.
• Build content feeds to detect malicious traffic based on known or detected indicators of compromise.
• Build automated log correlations in Splunk or a similar tool to identify anomalous and potentially malicious behavior.
• Act in concert with Cyber Threat Intelligence to understand threats and to determine what risk these threats present to the client.
• Incorporate CTI findings into threat hunting activities and workflow.
• Contribute to incident response teams, maintaining relevant communication in emails, ticket summaries, analysis and reporting. Work with Incident Handlers to provide recommendations for remediation of compromised systems and any relevant countermeasures.
• Review, create or document standard operating procedures, recommendations, projects specific documents and resource guides as needed.
• Supervise vulnerabilities and work with engineering teams to drive proper mitigations.
• Supervise security operations queues to ensure timely triage of operations events and requests
• Supervise global vulnerability feeds, assess impact to the business and respond promptly
• Participate in security incident investigations and retrospect on security events
• Ensure all required logging is enabled and collected in SIEM tool
• Participate in on-call rotations as needed to support continuous monitoring needs that may lay outside of business hours

Who You Are

You have experience in providing security operations services including threat hunting, vulnerability analysis and incident response in cloud native environments. You successfully establish relationships with clients based on collaboration, empathy, and pursuit of excellence.

• Bachelors + 5 years of related experience or Masters + 3 years of related experience focused on vulnerability analysis and monitoring, threat engineering, risk assessment, and penetration testing
• 5+ years’ experience in production security operations, threat hunting, and threat intelligence
• 5+ demonstrated ability administering and operating security tooling such as Nessus, OSQuery, Splunk, Burpsuite, Nmap, Wireshark, Falco, Tenable, Wiz.io, etc.
• 3+ years of technical experience supporting cloud operations in Azure/ AWS / GCP
• Ability to create custom correlation rules to detect known or suspected malware traffic patterns within security tools
• Packet-level knowledge of TCP/IP protocols and network applications and an understanding of TCP/IP routing behaviors
• Certifications such as CEH, Splunk, CISSP, Cloud Certs – AWS/GCP/Azure
• Understanding of regular expression and query languages
• Experience in Information Security with a focus on incident response and security engineering
• Experience analyzing events or incidents to triage the issue, find the root cause through log and forensic analysis, and determine security vulnerabilities, attacker exploit techniques, and methods for their remediation.
• Experience developing playbooks, run books, solve technical issues, and recognize and identify patterns
• Strong knowledge of security standard methodologies, principles, and common security frameworks. Such as MITRE ATT&CK, NIST, ISO 27001, OWASP-Top 10, CIS benchmarks.
• Knowledge of TCP/IP, OWASP Top 10, CVSS, Linux, Virtualization, Containers
• Good communication, organizational, and problem-solving skills in a dynamic environment
• Effective documentation skills, to include technical diagrams and written descriptions
• Ability to work independently and as part of a team with professional demeanour.

Why Cisco

We connect everything: people, processes, data, and things. We innovate everywhere, taking bold risks to shape the technologies that give us smart cities, connected cars, and handheld hospitals. And we do it in style with unique personalities who aren't afraid to change the way the world works, lives, plays, and learns.

We Are Cisco!