Senior Security Research Analyst - Internal Data
Location: Remote in the United States
The Senior Security Research Analyst - Internal Data is responsible for conducting in-depth analysis and enrichment of internally sourced security data to identify, assess, and investigate potential security threats and patterns within the SOC's infrastructure purview. Works within the Threat Fusion Cell to provide comprehensive threat intelligence insights through internally derived data correlation and analysis.
Responsibilities
Analyze EDR/SIEM tool data sources and SOAR tooling to contribute to automated collection of essential elements of information extraction in an effort to identify attack trends and campaigns from client alerting
Explore alerting data to filter for novel security incidents by creating and implementing periodic queries to identify previously undocumented malware and new attack TTPs
Facilitate Threat Fusion Cell automation efforts to maximize operational efficiency and effectiveness for delivery of threat intelligence
Collect and maintain client firmographic information and historical security touchpoints (malware, adversaries, tools noted in environment) to support threat detection and SOC operations
Conduct analysis on report items from collected data to provide quality intelligence to Advanced Threat Detection, SOC analyst teams, and Cyber Defense Platform users
Analysis should focus on corroborating findings, ascertaining attribution, highlighting infrastructure, identifying targets and cataloging all in a digestible format for report review and publishing
Follow process to identify recently processed high-profile SIR or MSS cases for which greater threat intelligence context exists and provide to SOC analyst teams in timely manner
Understand data structure for indicators derived from SOC client alerting and Open-Source intelligence feeds to provide succinct, enriched context to downstream analysts
Qualifications
Strong analytical and problem-solving skills with attention to detail; experience with VirusTotal, Joe Sandbox and other open-source intelligence tools
Experience with log analysis and forensic investigation techniques
Practical knowledge of Linux, macOS and Windows operating systems
Understanding of TCP/IP networking and the OSI model
Experience with SIEM platforms and log analysis tools
Familiarity with IDS/IPS systems
Knowledge of common programming or scripting languages
Strong written and verbal communication skills
Experience with packet analysis tools (e.g., Wireshark)
Ability to deconstruct complex problems and identify patterns
Preferred Qualifications:
Experience with malware analysis
Knowledge of threat hunting methodologies
Relevant security certifications (GCIA, GCIH, etc.)
Experience with automation and scripting for data analysis
Education/Experience:
Bachelor's degree in Computer Science, Information Security, or related field
1+ years of experience in security research or threat analysis
Experience with data analysis and enrichment techniques
Knowledge of security tools and technologies
About BlueVoyant
At BlueVoyant, we recognize that effective cyber security requires active prevention and defense across both your organization and supply chain. Our proprietary data, analytics, and technology, coupled with deep expertise, works as a force multiplier to secure your full ecosystem. Accuracy! Actionability! Timeliness! Scalability!
Led by CEO, Jim Rosenthal, BlueVoyant's highly skilled team includes former government cyber officials with extensive frontline experience in responding to advanced cyber threats on behalf of the National Security Agency, Federal Bureau of Investigation, Unit 8200, and GCHQ, together with private sector experts. BlueVoyant services utilize large real-time datasets with industry leading analytics and technologies.
Founded in 2017 by Fortune 500 executives, including Executive Chairman, Tom Glocer, and former Government cyber officials, BlueVoyant is headquartered in New York City and has offices in Maryland, Tel Aviv, San Francisco, London, Budapest, and Latin America.
All employees must be authorized to work in the United States. BlueVoyant provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, BlueVoyant complies with applicable state and local laws governing non-discrimination in employment in every location in which the company has facilities.
Disclaimer: Please note that pursuant to contractual requirements and applicable law, in order for employees to perform work on some of the company's federal contracts, U.S. citizenship is required. Accordingly, an employee's ability to perform work on such contracts is contingent upon the company's verification of the employee's citizenship status. Furthermore, individuals may be subject to additional background checks and fingerprinting.
BlueVoyant Candidate Privacy Notice
To understand how we secure and manage your personal data upon submitting a job application, please see our Candidate Privacy Notice, which can be found here - Candidate Privacy Notice
Powered by JazzHR