This is a hands-on security position working within the Information Security group and with the internal IT department at large. This position’s core focus is to ensure consistent, measurable end to endtriage and closureof securityrelated events The successful candidate will work toassess,develop,and deploydetectioncapabilitiesensuring enterprise systems and data are protected

The Role

We are looking for candidates whohave apassionforCyberSecurity,ThreatDetection,Threat Hunting, and Incident Response. You will be a key part of ourefforts to build and support a defensibleenvironment where we are able to detect,containand respond quickly to threats and compromisein ways that serve to enablethebusinessneedsahighly collaborative organization The environment is fast-paced and commonly on the leading edge of technology, including early adoption of various cloud servicesalong withthe challenges of integrating those services into our security practice.

Responsibilities

• Conductday-to-day Incident Response activities as well asadditionalSOC related detection and response activities asrequiredfor a global environment

• Design, engineer, and implement runbooks and playbooks forIncidentResponse

• Coordinate with both technical and business stakeholders during the incident response process.

• Perform host based,cloud based,network based, memory, or log analysis and/or forensics in support ofIncidentResponse investigations.

• Play an active role in CAA’sSecurityIncidentResponse efforts, working toidentifyand mitigate information securitythreats

• Reviewsecurity information,event logs,and reports, provide findings and recommendations

• Use input from IRM leadership and key security metrics to ensure technical security controls are meeting desiredobjectives; implement a process of continualreview and improvement to ensure the measurable effectiveness of CAA’s technicalcontrols

• Other projects or duties asassigned, including periodicon-call

Required Capabilities

• Aminimum of3years in Information Technology, ideallywith2years’ experiencein ahands-onIncidentResponse,ThreatHunting, or forensics role

• Abachelor’s or master’sdegree in a relevant field of work

• Strong technical background with experience in at leasttwoof the following

• Windows disk and memory forensics

• Network traffic analysis (netflow,pcap)

• Log Analysis

• Unix or Linux disk and memory forensics

• Malware analysis – both static and dynamic

• Astrong understanding of the fundamental operations of servers, operating systems, networks,firewalls,cloud applications,and infrastructure

• Expertisebuilding workflows and playbooks tofacilitatetheIncidentResponseprocess

• An understanding of the NIST framework and using a continuous improvement loop

• Has built and managed frameworks to test andvalidatethe effective operation of security controls; measuring the ability torespond tothreats and attacks at the earliest point in the kill chain.

Environment

CAA has aservice orientedcollaborative environment where we help ourcolleaguesthen focus on our own work.