XOR Security

Job Description: 
XOR Security is actively seeking a Digital Forensics Incident Response (DFIR) Analyst to enable our operational counterparts advanced analytics support to promote the rapid analysis of national level cyber threats and incidents.  The ideal candidate will provide technical support of a 24x7 cyber program in the areas of incident  response,  insider  threat  investigations, forensics, cyber threats and information security. 
Corporate duties such as solution/proposal development, corporate culture development, mentoring employees, supporting recruiting efforts, will also be required.  
Position is contingent on successfully completing a program-based background investigation. 
Required Qualifications: 
<ul>
<li>Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering. </li>
<li>Active CISSP. </li>
<li>One or more of the following certifications: GCIA, GCIH, GCFA, GCED, or other Information Assurance Technician (IAT) Level III certification (CASP+ CE, CCNP Security, CISA, CCSP). </li>
<li>Demonstrated understanding  of  incident  response,  insider  threat  investigations, forensics, cyber threats and information security.  </li>
</ul>
<ul>
<li>A minimum of seven (7) years of professional experience with a solid understanding of incident response, insider threat investigations, forensics, cyber threats and information security.  </li>
<li>A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host-based and network-based security monitoring, identifying and analyzing anomalous activities with familiarity in insider threat monitoring software, host- based forensic tools, intrusion detection systems, intrusion analysis functions, security information event management (SIEM) platforms, endpoint threat detection tools, security operations ticket management.  </li>
<li>Experience creating insider threat focused dashboards, reports and workflow diagrams.   </li>
<li>Experience  collecting  data  and  reporting  results;  handling  and escalating  security  issues  or  emergency  situations  appropriately;  providing incident  response  capabilities  to  isolate  and  mitigate  threats  to  maintain confidentiality, integrity, and availability for protected data.  </li>
<li>Experience with ad-hoc training to junior, mid, senior members of a cyber work force in a collaborative environment. </li>
</ul>
<ul>
<li>Subject matter expert in the field of digital media exploitation or forensics. </li>
<li>Existing Subject Matter Expertise of Advanced Persistent Threat or Emerging Threats. </li>
<li>Proficiency in utilizing various packet capture (PCAP) applications/engines and in the analysis of PCAP data. </li>
<li>Ability to work on-call during critical incidents or to support coverage requirements (including weekends and holidays when required). </li>
<li>Experience supporting a SOC program in incident response tools and techniques, specifically with forensics tools such as EnCase, Forensic Toolkit, etc. </li>
</ul>
<ul>
<li>Experience with static and dynamic malware analysis, including reverse engineering of binaries. </li>
<li>Familiarity with coding, scripting languages (BASH, Powershell, Python, PERL, RUBY etc.) or software development frameworks (.NET). </li>
<li>Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms, Data Loss Prevention (DLP) systems, and log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk or ArcSight). </li>
<li>Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts. </li>
<li>Understanding of hardware configurations and comfort with disassembling and reassembling computers and periphery devices. </li>
</ul>
<ul>
<li>Expert understanding of computer file systems, hard drive architecture and connection types. </li>
<li>In-depth experience with file system forensics, registry analysis, Internet history analysis, steganography and encryption detection and analysis, forensic media imaging, timeline analysis, email analysis, signature/hash analysis. </li>
<li>Ability and experience extracting and managing complex large data sets.  </li>
<li>Strong documentation and written communication skills with technical report writing experience </li>
</ul>
Desired Qualifications: 
<ul>
<li>Experience managing a technical team </li>
<li>Advanced troubleshooting skills </li>
<li>Hard drive and/or cellular phone repair skills </li>
<li>Forensic tool and script development </li>
<li>Metadata extraction and analysis </li>
</ul>
<ul>
<li>Network and intrusion analysis </li>
<li>Mobile/Cellular device analysis </li>
<li>Forensic video analysis </li>
<li>Digital forensic instructor </li>
<li>Software development </li>
</ul>
<ul>
<li>Database analysis/development </li>
<li>Reverse engineering </li>
<li>Application analysis </li>
<li>Network forensics </li>
<li>Intrusion analysis </li>
</ul>
<ul>
<li>Intelligence analysis </li>
<li>Social networking analysis </li>
<li>Law enforcement investigation </li>
<li>Finished intelligence report writing </li>
</ul>
Closing Statement: 
XOR Security offers a very competitive benefits package including paid health insurance coverage from first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits. 
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V. 
Citizenship Clearance Requirement Applicants selected may be subject to a government security investigation - Applicants must meet eligibility requirements – US CITIZENSHIP.

Alexandria

Digital Forensics Incident Response (DFIR) Analyst

XOR Security is currently seeking several Cyber Hunt SME to support an Agency-level SOC at DHS. The SOC program provides comprehensive Computer Network Defense and Response support through 24×7×365 monitoring and analysis of potential threat activity targeting the enterprise.  Senior SOC analysts will conduct security event monitoring, advanced analytics and response activities in support of the CND operational mission.  The positions will respectively focus on Cyber Hunt, Detective Content Development, Malware Analysis, and Cyber Threat Intelligence (skills in more than one cyber discipline are preferred).  To support this vital mission, XOR staff are on the forefront of providing Advanced CND Operations, and Systems Engineering support to include the development of advanced analytics and countermeasures to protect critical assets from hostile adversaries.
To ensure the integrity, security and resiliency of critical operations, we are seeking candidates with diverse backgrounds in cyber security systems operations, analysis and incident response. Strong written and verbal communications skills are a must. The ideal candidate will have a solid understanding of cyber threats and information security in the domains of TTP’s, Threat Actors, Campaigns, and Observables. Additionally the ideal candidate would be familiar with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management.
Candidate must have the required Qualifications:
<ul>
<li>For a Senior, at least 5 years of experience in a cyber network defense environment.</li>
<li>Active top Secret and/or DHS Agency Clearance.</li>
<li>Strong analytical and technical skills in computer network defense operations, ability to lead efforts in Incident Handling (Detection, Analysis, Triage), Hunting (anomalous pattern detection and content management) and Malware Analysis.</li>
<li>Prior experience and ability to with analyzing information technology security events to discern events that qualify as a legitimate security incidents as opposed to non-incidents. This includes security event triage, incident investigation, implementing countermeasures, and conducting incident response.</li>
<li>Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms and log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk or ArcSight).</li>
<li>Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts.</li>
<li>Strong logical/critical thinking abilities, especially analyzing security events (windows event logs, Tanium queries, network traffic, IDS events for malicious intent).</li>
<li>Strong proficiency Report writing – a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting, excellent verbal and written communications skills and ability produce clear and thorough security incident reports and briefings.</li>
<li>Excellent organizational and attention to details in tracking activities within various Security Operation workflows.</li>
<li>A working knowledge of the various operating systems (e.g. Windows, OS X, Linux, etc.) commonly deployed in enterprise networks, a conceptual understanding of Windows Active Directory is also required, and a working knowledge of network communications and routing protocols (e.g. TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g. SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.).</li>
<li>Experience with the identification and implementation of counter-measures or mitigating controls for deployment and implementation in the enterprise network environment.</li>
<li>Experience in mentoring and training junior and mid-level analysts. </li>
</ul>
Desired Qualifications:
<ul>
<li>Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering.</li>
<li>One or more certifications for CND Analysts:  GCIA, GCED, GCFE, GCTI, GNFA, GCIH, CND, ECSA, OSCP, OSEE, OSCE.</li>
<li>One or more certifications for malware or forensic analysts:  GCFA, GCFE, GREM, CHFI.</li>
<li>Existing Subject Matter Expertise of Advanced Persistent Threat or Emerging Threats.</li>
<li>Expertise on policies, industry trends, techniques related to penetration testing.</li>
<li>Proficiency in utilizing various packet capture (PCAP) applications/engines and in the analysis of PCAP data.</li>
<li>Experience with one or more of the following technologies Network Threat Hunting (Sqrrl), Big Data Analytics (Splunk), Endpoint Threat Detection (Tanium), SIEM (ArcSight), workflow and ticketing (HP Service Manager), Intrusion Detection System (IBM ISS).</li>
<li>Ability to work on-call during critical incidents or to support coverage requirements (including weekends and holidays when required).</li>
<li>Familiarity with scripting languages (BASH, Powershell, Python, PERL, RUBY etc.) or software development frameworks (.NET).</li>
</ul>
Closing Statement:
XOR Security offers a very competitive benefits package including health insurance coverage from the first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance Requirement
Applicants selected may be subject to a government security investigation and must meet eligibility requirements - US CITIZENSHIP and TOP SECRET CLEARANCE REQUIRED!

Springfield

Cyber Hunt SME

CRI Group

Tasks
<ul>
<li>Support project teams in improving the security posture of systems they develop• Analyse SAST and DAST findings (initial triage with the team), performing code review of implemented corrections.• Promote secure development practices (e.g. OWASP TOP 10)• Lead threat modelling exercises with project teams• Improve management of secrets.• Define security requirements• Coordinate security of supply chain improvements• Take part in risk assessments.• Advance security enhancements in DevSecOps processes.• Animate the Security Champions community• Provision of security studies associated with information system projects• Coordination of compliance assessments for both on-prem and cloud applications• Support in definition and execution of the vulnerability management process• Security gap analysis• Evaluations of security products and tools for information systems• Assistance in the implementation of IS security policies• Security specifications for information systems• Management of security tests</li>
</ul>
Key Requirements:
Proven experience in Information Systems Development and Information Systems Security, preferably for Java EE technology (at minimum understanding the code and architectural blueprints, however hands-on programming experience is a plus)
• Good presentation skills (ability to chair large meetings)• Good knowledge of English (spoken, written)• IT Security certification (CISSP, CEH, GIAC or similar) is a plus
At least 1 certification among
• GCED (GIAC Certified Entreprise Defender)• GPPA (GIAC Certified Perimeter ProtectionAnalyst)• GCWN (GIAC Certified Windows SecurityAdministrator)• GCUX (GIAC Certified UNIX SecurityAdministrator)• GCCC (GIAC Certified Critical Controls)• SSCP ((ISC)2 Certified Systems SecurityPractitioner)• CAP ((ISC)2 Certified Authorization Professional)• CISSP (Certified Information Systems SecurityProfessional)• CISA (Certified Information Systems Auditor)• CISM (Certified Information Security Manager)• GSEC (GIAC Certified Security Essentials)• ECSA (EC-Council Certified Security Analyst)• SCPO (SABSA Certified Security Operations &amp;Service Management Practitioner)• ECSA (EC-Council Certified Security Analyst)• ISO 27001 Lead implementer• ISO 27001 Lead Auditor• ISO 27005 Risk Manager• or an equivalent certification recognizedinternationally (subject to acceptance)
Additional Requirements:
At least 1 certification in the field of incident handling:
• GCIH (GIAC Certified Incident Handler)• GCIA (GIAC Certified Intrusion Analyst)• ECIH (EC-Council Certified Incident Handler)• CSIH (SEI Certified Computer Security IncidentHandler)• SCMO (SABSA Certified Security Operations &amp;Service Management Specialist)• or an equivalent certification recognizedinternationally (subject to acceptance as a validcredential by the Contracting EU-I)
The following documents / procedures will be requested to successfully complete the hiring process :
<ul>
<li>A copy of your university degree(s)</li>
<li>A copy of your criminal record</li>
<li>Security Clearance Procedure</li>
</ul>
WHO WE ARE?
CRI company part of VASS Group, leads the digital transformation and cyber security in the European Union.
CRI operates serving the European Union Institutions, telecom operators, financial institutions and governmental bodies through a comprehensive offering of services and technologies.
Please visit our website and let's get in touch: <a href="https://cri-group.eu/" rel="noopener noreferrer nofollow ugc" target="_blank">www.cri-group.eu</a>

Brussel

Information System Security Analyst

Job Description: Night time Weekend (Part-Time) Cyber Security Operation Center (CSOC) Analyst
XOR Security is currently seeking various Mid Level SOC Analyst to support a large commercial financial entity Cyber Security Operation Center (CSOC).  The program provides comprehensive Computer Network Defense and Response support through 24×7×365 monitoring and analysis of potential threat activity targeting the enterprise.  CSOC Analysts will conduct security event monitoring, advanced analytics and response activities in support of the CND operational mission.  To support this vital mission, XOR staff are on the forefront of providing Advanced CND Operations to include the development of advanced analytics and countermeasures to protect critical assets from various cyber threats. To ensure the integrity, security and resiliency of critical operations, we are seeking candidates with diverse backgrounds in cyber security systems operations, analysis and incident response. A strong work ethic, diligent time and attendance, written and verbal communications skills are a must along with the ability to work night shifts. The ideal candidate will have a solid understanding of cyber threats and information security in the domains of TTP’s, Threat Actors, Campaigns, and Observables. Additionally, the ideal candidate would be familiar with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management.
 Available Shifts:
Saturdays from: 10am - 10:30pm
 NOTE:  This is a long-term commitment.
Required Qualifications:
<ul>
<li>Minimum 1-3 years of experience in network defense environments.</li>
<li>Strong analytical and technical skills in computer network defense operations, ability to lead efforts in Incident Handling (Detection, Analysis, Triage), Hunting (anomalous pattern detection and content management) and Malware Analysis.</li>
</ul>
<ul>
<li>Prior experience and ability to with analyzing information technology security events to discern events that qualify as a legitimate security incidents as opposed to non-incidents. This includes security event triage, incident investigation, implementing countermeasures, and conducting incident response.</li>
<li>Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms and/or log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk).</li>
<li>Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts.</li>
</ul>
<ul>
<li>Strong logical/critical thinking abilities, especially analyzing security events from host and network event sources e.g. windows event logs, AV, EDR, network traffic, IDS events for malicious intent).</li>
<li>Strong proficiency Report writing – a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting, excellent verbal and written communications skills and ability produce clear and thorough security incident reports and briefings.</li>
<li>Excellent organizational and attention to details in tracking activities within various Security Operation workflows.</li>
<li>A working knowledge of the various operating systems (e.g. Windows, OS X, Linux, etc.) commonly deployed in enterprise networks, a conceptual understanding of Windows Active Directory is also required, and a working knowledge of network communications and routing protocols (e.g. TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g. SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.).</li>
<li>Experience with the identification and implementation of counter-measures or mitigating controls for deployment and implementation in the enterprise network environment.</li>
<li>Ability to support coverage requirements for various shifts during holidays and weekends when required.</li>
</ul>
Desired Qualifications:
<ul>
<li>Should have Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering</li>
<li>For Mid-level analysts, one or more certifications for CND Analysts:  GCIA, GCED, GCFA, GCFE, GCTI, GNFA, GCIH, ECSA, CHFI, CISSP, Security+, Network+, CEH, CND.</li>
<li>An understanding in researching Emerging Threats and recommending monitoring content within security tools.</li>
</ul>
<ul>
<li>Experience in analyzing netflow data and packet capture (PCAP).</li>
<li>Experience with one or more of the following technologies, specific tools: Splunk (including Core and ES), Cisco FireSight, Carbon Black.</li>
</ul>
<h3>Closing Statement:</h3>
XOR Security offers a very competitive benefits package including health insurance coverage from first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance RequirementApplicants selected may be subject to a government security investigation and must meet eligibility requirements – US CITIZENSHIP REQUIRED.

Vienna

(Part-Time) Cyber Security Operation Center (CSOC) Analyst (Night Shift)

XOR Security is currently seeking several talented Insider Threat Analysts to support a federal agency. The Insider Threat program is a standalone part of an advanced analytics capability of the larger Security Operation Center (SOC) program that provides comprehensive Computer Network Defense and Response support through monitoring and analysis of potential threat activity targeting the enterprise. Insider Threat Analysts will conduct advanced security event analytics, insider threat monitoring, log analysis, host-based forensics, incident response, and case management. In support of this vital mission, XOR staff are on the forefront of providing Advanced CND Operations, and Systems Engineering support to include the development of advanced analytics and countermeasures to protect critical assets from hostile adversaries. To ensure the integrity, security and resiliency of critical operations, we are seeking candidates with diverse backgrounds in cyber security systems operations, analysis and incident response. Strong written and verbal communications skills are a must. The ideal candidate will have a solid understanding of incident response, insider threat investigations, forensics, cyber threats and information security in the domains of TTP’s, Threat Actors, Campaigns, and Observables. Additionally the ideal candidate would be familiar with insider threat monitoring software, host-based forensic tools, intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management.
Candidate must have the required Qualifications:
• 7+ years of experience in a cyber network defense or insider threat environment. • Strong analytical and technical skills in computer network defense operations, ability to lead efforts in Incident Handling (Detection, Analysis, Triage), Hunting (anomalous pattern detection and content management) and Malware Analysis.• Prior experience and ability to with analyzing information technology security events to discern events that qualify as a legitimate security incidents as opposed to non-incidents. This includes security event triage, incident investigation, implementing countermeasures, and conducting incident response.• Strong logical/critical thinking abilities, especially analyzing security events (windows event logs, network traffic, IDS events for malicious intent).• Strong proficiency Report writing – a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting, excellent verbal and written communications skills and ability produce clear and thorough security incident reports and briefings.• Excellent organizational and attention to details in tracking activities within various Security Operation workflows.• A working knowledge of the various operating systems (e.g. Windows, OS X, Linux, etc.) commonly deployed in enterprise networks, a conceptual understanding of Windows Active Directory is also required, and a working knowledge of network communications and routing protocols (e.g. TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g. SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.).• Experience with the identification and implementation of counter-measures or mitigating controls for deployment and implementation in the enterprise network environment.• Experience conducting Forensic Analysis on compromised systems using digital forensics tools (e.g. EnCase, FTK)• Experience with Cyber, Insider Threat and Policy Violation Investigations, and conducting eDiscovery investigations• Proficiency in cyber threat exploitation patterns, from discovery through establishing a persistent presence• Provide subject matter expertise support in the detection, analysis and mitigation of malware, trends in malware development and capabilities, and proficiency with malware analysis capabilities.• Knowledge and proficiency using the tools and techniques required to successfully conduct dynamic and static analysis of binary samples.
Desired Qualifications:• Active Top Secret and SCI eligible.• Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering.• Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms and log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk or MS Sentinel).
<ul>
<li>Experience with counterintelligence investigations within the intelligence community.</li>
<li>Coordinating with FinCEN or similar entities on intelligence analysis and tippers.• Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts.• Digital Forensic or Incident Response Certifications such as: GCIA, GCED, GCFA, GCFE, GCTI, GNFA, GCIH, ECSA, CHFI, CISSP, Security+, Network+, CEH, CND. CCE, CFC, EnCE, CFCE, GREM.• Experience in recommending and coordinating countermeasures to operational CND personnel.• Ability to work on-call during critical incidents or to support coverage requirements (including weekends and holidays when required).• Familiarity with scripting languages (BASH, Powershell, Python, PERL, RUBY etc.) or software development frameworks (.NET).</li>
</ul>
<h3>Closing Statement:</h3>
XOR Security offers a very competitive benefits package including health insurance coverage from first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance RequirementApplicants selected may be subject to a government security investigation and must meet eligibility requirements - US CITIZENSHIP and PUBLIC TRUST CLEARANCE REQUIRED.

Washington

Insider Threat Analysts

Apply to GCED Cyber Security Jobs in companies remotely and near you. New GCED Cyber Security Jobs added daily.

Job Position and Company	Location	Tags	Posted
Digital Forensics Incident Response (DFIR) Analyst at XOR Security	Full Time Forensic CCSP Analyst Incident Response
Cyber Hunt SME at XOR Security	Active Directory Analytics Arcsight BASH Big Data
Information System Security Analyst at CRI Group	CEH CISA CISM Cissp Clearance
(Part-Time) Cyber Security Operation Center (CSOC) Analyst (Night Shift) at XOR Security	Active Directory Analytics CEH Cissp Clearance
Insider Threat Analysts at XOR Security	Active Directory Analytics BASH CEH Cissp

GCED Cyber Security Jobs

0 GCED Cyber Security Jobs. Page 1 of 1

5 closed gced cyber security jobs:

Subscribe to the weekly
Cyber Security Jobs Newsletter

GCED Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

GCED Cyber Security Jobs

0 GCED Cyber Security Jobs. Page 1 of 1

5 closed gced cyber security jobs:

Subscribe to the weekly Cyber Security Jobs Newsletter

GCED Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Subscribe to the weekly
Cyber Security Jobs Newsletter