Desired Experience and Qualifications:

• 3+ years of experience in a security operations role performing threat monitoring, investigation, and incident response
• Demonstrated experience in incident response investigation documentation, escalation, and SOC practices at large enterprise
• Experience analyzing data and alerts from email, network, endpoint, cloud, and infrastructure tools as part of the investigation process
• A practical understanding of cloud, endpoint and network forensics concepts
• Experience using the MITRE ATT&CK framework or cyber kill chain concept in an operations context
• Experience with SIEM technology and data correlation as a concept
• Practical working knowledge of cloud infrastructure (AWS, Azure, GCP); able to describe cloud architecture and common uses
• Ability to describe the incident response lifecycle end-to-end and to apply it creatively to scenarios
• A practical understanding of workflow automation
• Practice with the NIST framework and standards in an operations context
• Formal training / education in security monitoring and incident response concepts (SANS or Security+)

Other Requirements

• US Citizenship

Preferences / Nice to Have:

• Workflow tools: XSOAR, Jira, ServiceNow
• Data analytics tools: Devo, Splunk, QRadar, ArcSight, SumoLogic, Azure Sentinel, etc.
• Security Tools: Firewalls, EDR, web proxy, AntiVirus and AntiMalware, email security gateways
• Experience with Cloud Technologies: Azure, GCP, AWS
• Experience working with US Government agencies and programs