Security Analyst III - Weekday Afternoons

Position Summary

Security Analyst III, which directly correlates to the Security Operations Center (SOC) Tier III analyst, are focused on the explanative analysis of an event; why and how. These individuals demonstrate a curiosity that is tempered with training and experience. They are capable of developing greater context to events, allowing for more in-depth analysis and leveraging this to develop patterns of behavior in a client. Tier III analysts receive escalations from Tier I and II analysts to conduct advanced root cause analysis.

These analysts will mentor Tier I and II analysts and work with Squad Leadership and subject matter experts on their chosen specialization and others to gain greater understanding of the problems and environments, as well as to develop their own skills. These individuals will be advanced in their chosen specialty. Tier III analysts will also be integral in producing analytical content and responsible for forensic investigations.

The shift for this position is Monday - Friday, 2 P.M. - 10 P.M. EST.

Position Responsibilities

• Engage with customers on prescribed meeting cadences and ad-hoc requests, in a subject matter expert capacity, related to deployed security technologies and their alternatives, Deepwatch products, and Deepwatch Squad activities
• Monitor, identify, and report any gaps in log collection or reporting as soon as possible to the customer and Deepwatch Engineering
• Provide after-hours support to the Squad and customers, as needed, to assist in resolution of customer incidents
• Develop and deploy dashboards and reporting to meet customer needs
• Work alongside the Squad Leadership to support customers and their security; create and work within project plans to mature both customers and their security posture
• Work pre-defined shifts, as necessary, to support coverage gaps
• Validate suspicious events and incidents using open-source and proprietary intelligence sources
• Document and manage incident cases in our case management solution
• Assist with initial incident response and forensics requests
• Notify assigned customers of security incidents
• Triage support requests and help desk queue to maintain SLA
• Perform as an escalation point for Tier I and II Analysts, as necessary, related to alerts
• Mentor and assist Tier I and II Analysts with professional development as well as on-the-job training and mentorship in systems including Splunk, ServiceNow, and third-party threat intelligence tools
• Report all operational issues or problems to the Squad leadership
• Work within the Squad and across Squads, Deepwatch’s Customer Success Managers, and other Deepwatch business functions to enhance Deepwatch’s product offerings and mature Deepwatch’s business practices
• Keep up-to-date with information security news, techniques, and trends
• Author unique analytical products
• Produce original content regarding new threats, techniques and information for internal and external consumption
• Develop an area of specialty with the goal of becoming a subject matter expert (e.g. Malware Analysis, Host Forensics, Network Forensics, Threat Hunting, Splunk Administration)
• Learn new tactics, techniques, and procedures for incident detection

Required Experience, Skills and Knowledge

• 4+ years in Cybersecurity Operations, with preference for MSSP
• Incident Management
• Advanced experience with Splunk or a comparable SIEM
• Proven and demonstrated proficiency with SOAR, ServiceNow or comparable ticketing systems, and Threat Intelligence tools and platforms
• Advanced knowledge of Operating Systems and Networks
• Expertise with some or all of the following:
  • Full packet capture analysis (Wireshark, Netwitness)
  • Malware analysis (Static/Dynamic)
  • Host forensics (Windows)
  • Email Analysis
  • Virtualization (VMWare, Virtualbox)
• Strong communication skills, written and verbal

Preferred Experience, Skills and Knowledge

• Degree in Information Security or Information Technology
• Scripting Experience
• Industry recognized cybersecurity certifications:
  • SANS, EC-Council, CompTIA, GCIA, GCIH, CEH, CySA, Net+/Sec+

ITAR Compliance

This position will have access to customer data and as such is subject to International Traffic in Arms Regulations (ITAR). Upon application, candidates will be asked to confirm that they are a U.S. Person as defined by the following:

• A citizen of the U.S.
• A lawful permanent resident of the United States
• A person admitted to the United States as a refugee
• A person that has been granted asylum by the United States government

The intent of this requirement is not to verify employment eligibility overall, but to ensure compliance with import/export regulations. If you do not meet these requirements, we encourage you to apply for other open roles at Deepwatch. This information will be verified upon offer of employment.

Colorado* Candidates:

(Colorado only*) Salary range for this role is $80,000 to $100,000.  You may also be eligible for incentive pay, equity, and/or benefits.

*Note: Disclosure per sb19-085 (8-5-201 et seq).

#LI-KH1