Incident Response Senior Advisor - Shift Leader

Role Responsibilities

• Review security-related events and assess their risk and validity based on available telemetry from network, endpoint, and global threat intelligence information in order to provide clients with concise, detailed, and well-written incident reports, root causes identification, and remediation recommendations
• Provide customers with understandable context around their security environment and threats
• Interface with clients to address their issues, concerns, and questions, and drive to satisfactory closure any issues that impact the service and its value
• Work with customer and internal Secureworks incident response teams to resolve ongoing intrusions, malware outbreaks, and other security incidents
• Provide mentorship to SecureWorks team members and clients on security strategy, tactics, techniques, and procedures
• Use the Secureworks platform to proactivity hunt for and investigate activity within the client environment
• Use experience gained during incident investigations as well as malware and exploit analysis to contribute to the development of indicators of compromise
• Provide support for all other teams involved in the delivery of the service whenever they have questions or requests from customers
• Act as first point of coordination for escalations coming on shift directly from customers via chat, tickets, investigations, (with support from manager)
• Act as shift coordinator by prioritizing the tasks, activities, internal and external client’s requests
• Collect and validate flows/processes/tools issues reported by his shift and present them to the manager
• Involve in technical assessments, coaching and/or development of training programs for the team members
• Tracking and reporting of KPIs

Requirements

Knowledge

Significant experience with and expert understanding of:

• Two (2) or more of the following operating systems (Windows, Linux, Mac OS) at a filesystem level
• Fundamental Internet protocols, services and technologies (e.g. HTTP/HTTPS, DNS, SMTP, SSH, LDAP, TCP/IP, UDP, ICMP, JSON, REST, etc.)
• Common security controls (e.g. firewalls, proxies, IDS/IPS, WAF, etc.)

Experience with and strong understanding of:

• Performing both endpoint and network-based investigations
• Reviewing logs to identify evidence of past intrusions
• Pivot off indicators within networks to identify the scope and breadth of attacks
• Malware and exploit kit functionality
• Operating system and application exploits
• Lateral movement, living-off-the-land, and persistence establishment mechanisms
• Detection of anomalous system activity
• Threat hunting methodologies
• Incident response and incident handling processes

Skills and Abilities

Certifications