C002914 Threat Hunting Analyst (NS) - WED 27 SEP RELAUNCH
Mons, Wallonia, Belgium
NOTE: Previously proposed candidates were non-compliant for the following reasons: - not a single candidate matched the mandatory experience requirement.
Deadline Date: Wednesday 27 September 2023
Requirement: Threat Hunting Analyst
Location: Mons, BE
Full time on-site: Yes
Not to Exceed Rate: 106 EUR
Total Scope of the request (hours): 315
Required Start Date: 6 November 2023
End Contract Date: 31 December 2023
Required Security Clearance: NATO SECRET
Specific Working Conditions: Normal office environment with standard working hours, but may exceptionally be required to work non-standard hours in support of a major Cyber Incident, or on a shift system for a limited period of time due to urgent operational needs.
Duties and Role:
As a Cyber Security Threat Hunting Analyst the incumbent will work alongside a team of Security Analysts to proactively detect cyber security attacks against NATO networks. They will research and and react to the latest threats, using industry leading tools to discover new and ongoing attacks.
- Provide subject matter expertise supporting the end-to-end threat hunting process.
- Develop hypotheses to be used in a threat hunt for given threat groups.
- Create security tool content such as searches, reports and dashboards to facilitate threat hunting.
- Perform indepth analysis to deliver conclusions and recommendations.
- Review and develop logging configurations to enable a comprehensive threat hunting capability.
- Develop and document threat hunting procedures.
- Document analysis, findings, and recommendations in reports and presentations to be delivered to stakeholders.
- Tasks in support of NATO network monitoring and other NCSC Operations branch activities.
Skill, Knowledge & Experience:
- The candidate must have a currently active NATO SECRET security clearance
- A university degree at a nationally recognised/certified University in a technical subject with substantial Information Technology (IT) content and two years of specific experience. Exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate's particular abilities or experience that is/are of interest to NCI Agency; that is, at least 4 years extensive and progressive expertise in the duties related to the function of the post.
- Comprehensive knowledge of the principles of computer and communications security, networking, and the vulnerabilities of modern operating systems and applications.
- Experience in analysis of threat actor group attack patterns, tactics, techniques, and procedures (TTPs).
- Knowledge of the TaHiTI threat hunting methodology and the MITRE ATT&CK framework.
- Strong analytical and problem-solving abilities, ability to identify patterns, detect anomalies and make accurate, informed decisions.
- Experience in performing indepth cyber security analysis in large, complex networks using security use cases, relevant datasets, and documentation.
- Expertise in at least three of the following areas and a high level of experience in several of the other areas: Cyber security threat hunting; Security Information and Events Management systems (SIEM) – e.g. Splunk; Splunk processing language; Network and host based intrusion detection systems; Sysmon configuration, Windows, and Linux log analysis; Full Packet Capture systems (FPC) – e.g. Niksun, RSA/NetWitness; Data visualisation and statistical analysis; Technical report writing
- Good written and verbal communication skills (English)
- A good understanding of Security, Orchestrations, Automation and Response (SOAR) concepts and their benefits to the protection of CIS infrastructures.
- Strong knowledge of malware families and network attack vectors.
- Experience in intrusion detection and incident handling.
- Ability to analyse attack vectors against a particular system to determine attack surface.
- Industry leading certification in the area of cyber security such as GCFA, GCIA, GNFA.
* Salary range is an estimate based on our InfoSec / Cybersecurity Salary Index 💰
Tags: Automation Clearance GCFA GCIA GNFA Intrusion detection Linux Log analysis Malware MITRE ATT&CK Monitoring NATO RSA Security analysis Security Clearance SIEM SOAR Splunk TTPs Vulnerabilities Windows
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Analyste CERT / Incident Responder junior (H/F) jobs
- Open SOC Analyst jobs
- Open Senior Cybersecurity Engineer jobs
- Open Analyste CERT / Incident Responder senior (H/F) jobs
- Open Electronic Warfare Advanced Tactical Trainer jobs
- Open IT Security Analyst jobs
- Open Information Security Officer jobs
- Open Senior Information Security Engineer jobs
- Open Consultant SOC / CERT H/F jobs
- Open Cyber Security Specialist jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Security Operations Engineer jobs
- Open Staff Product Security Engineer jobs
- Open Senior SOC Analyst jobs
- Open Product Security Engineer jobs
- Open Staff Security Engineer jobs
- Open Staff Information Security Engineer jobs
- Open o365 Security Architect jobs
- Open Infosec Risk Manager jobs
- Open Cybersecurity Consultant jobs
- Open Chief Information Security Officer jobs
- Open Fortinet Firewall Engineer jobs
- Open Cyber Security Architect jobs
- Open Ingénieur DevSecops H/F jobs
- Open Application security-related jobs
- Open Risk assessment-related jobs
- Open Network security-related jobs
- Open SaaS-related jobs
- Open Governance-related jobs
- Open Pentesting-related jobs
- Open Java-related jobs
- Open Analytics-related jobs
- Open ISO 27001-related jobs
- Open Clearance-related jobs
- Open Vulnerability management-related jobs
- Open CISM-related jobs
- Open Security assessment-related jobs
- Open DevOps-related jobs
- Open APIs-related jobs
- Open IAM-related jobs
- Open Threat intelligence-related jobs
- Open Malware-related jobs
- Open Splunk-related jobs
- Open Kubernetes-related jobs
- Open CISA-related jobs
- Open DevSecOps-related jobs
- Open Terraform-related jobs
- Open IDS-related jobs
- Open GDPR-related jobs