XOR Security

<h3>Job Description:</h3>
XOR Security is currently seeking talented SOC Analyst for an exciting position supporting one of our premier clients. Our project is aimed at establishing cutting-edge techniques for network defense, identifying threats and detecting malicious activity using advanced toolsets. 
The ideal candidate will have hands-on experience as a SOC analyst performing Incident Response and Intrusion Detection on an operational Federal network.  The candidate will Monitor and analyze network traffic, Intrusion Detection Systems (IDS), security events and logs and provide a technical resource and escalation point for tier 1 analysts.  The candidate will perform incident response to investigate and resolve security incidents.  The candidate will need to be able to determine between false and true positives events, prioritizing them appropriately and see them through from end to end.  Additionally, the candidate will perform or review root cause analysis efforts following incident recovery.  The candidate will compose security alert notifications and other communications on behalf of the SOC.
In addition, the candidate will need to stay up to date with current vulnerabilities, attacks, and countermeasures.  The candidate will Develop follow-up action plans to resolve reportable issues and communicate with the other technologists to address security threats and incidents.  Also, the candidate will Regularly develop new use cases for automation and tuning of security tools.  The candidate will Define and create privacy and security reportable issues metrics and reports.  The candidate will need to contribute to security strategy and security posture by identifying security gaps, evaluate and implement enhancements.  The ideal candidate will possess a strong technical expertise of log and monitoring management systems, security event monitoring systems, network-based and host-based intrusion detection systems, firewall technologies, malware detection and enterprise-level antivirus solutions/systems, VPN technologies and encryptions standards
Location:
Washington D.C., USA
Schedule:
6am - 2pm or 10am - 6pm. Analyst should be flexible for both for potential rotation.
<h3>Skills and Qualifications:</h3>
<h4>Required Qualifications:</h4>
<ul>
<li>An industry technical certification such as GCIH</li>
<li>Experience with tools such as Active Directory, Cisco IOS, MS Server, ESA, WSA, Stealthwatch, AMP, Splunk, FortiSIEM, SNORT, Yara, IronPort, and Firepower.</li>
<li>Experience with deployment and documentation of enterprise project management and change management processes</li>
<li>Ability to identify solutions to potential network issues/embrace network simplification and strengthened security</li>
<li>Ability to conduct event triage and analysis and incident investigation</li>
<li>Three (3) years of experience in network defense environments</li>
</ul>
<h4>Desired Qualifications:</h4>
<ul>
<li>Understanding of command line scripting and implementation (e.g., Python, Powershell)</li>
<li>Ability to write new content/searches/scripts (e.g., Splunk dashboards, Splunk ES alerts, SNORT signatures, Python scripts, Powershell scripts)</li>
<li>Familiarity with Splunk Enterprise Security</li>
<li>Strong understanding of networking (TCP Flags, TCP Handshake, IP addressing, Firewalls, Proxy, IDS, IPS)</li>
<li>Ability to perform Netflow / packet capture (PCAP) analysis</li>
<li>Experience with cyber threat hunting</li>
<li>Bachelor’s Degree in Computer Science, Computer Engineering, Information Systems or equivalent experience</li>
</ul>
<h3>Closing Statement:</h3>
XOR Security offers a very competitive benefits package including health insurance coverage from the first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance RequirementApplicants selected may be subject to a government security investigation and must meet eligibility requirements - US CITIZENSHIP and PUBLIC TRUST CLEARANCE REQUIRED.

Washington

Mid Level SOC Analyst

Avertium

Avertium is the security partner that companies turn to for end-to-end Cybersecurity solutions that attack the chaos of the cybersecurity landscape with context. By fusing together human expertise and a business-first mindset with the right combination of technology and threat intelligence, Avertium delivers a more comprehensive, more programmatic approach to cybersecurity - one that drives action on the ground and influence in the boardroom. That's why over 1,200 mid-market and enterprise-level organizations across 15 industries turn to Avertium when they want to be more efficient, more effective, and more resilient when waging today's cyber war. Show no weakness.®The DFIR Consultant will contribute to Avertium’s DFIR practice, implement and execute best practices for incident handling, investigation and reporting, continuously develop the skills and expertise required to achieve customer objectives, and work with customers and other partners to respond to incidents, identify root causes, recommend solutions, and recover compromised environments.
<h3>Responsibilities:</h3>
<ul>
<li>Lead incident response engagements. Understand client requirements, coordinate the incident response team and liaising with client’s business stakeholders and technical teams.</li><li>Liaise with client third parties including legal, insurance and service providers, and provide guidance and subject matter expert advice to customer</li><li>Advise clients on business, technical, regulatory and reputation risk.</li><li>Advise clients on strategies to contain incidents and limit business impact of cyber incidents</li><li>Advise other incident response team members on strategies and techniques to accomplish client objective</li><li>Collect technical evidence from clients’ environments to prepare for forensic investigations</li><li>Conduct forensic investigations to determine the scope and impact of cyber incidents</li><li>Determine root cause of incidents using available evidence and analytical tools</li><li>Determine scope of data access and exfiltration</li><li>Provide recommendations and guidance to successfully evict threat actors from customer environments</li><li>Gather intelligence on threat actors to inform recommended containment, remediation and recovery actions</li><li>Develop threat intelligence reports and briefings in support of Avertium’s CTI and MSS groups</li><li>Manage the recovery of clients’ IT infrastructure during and after cyber attacks</li><li>Brief clients’ management, IT teams and third parties during and after cyber attacks</li><li>Prepare and deliver post-incident reports to client teams</li><li>Conduct threat hunts within EDR and SIEM tools for managed detection and response customers</li><li>Support team members in deeply technical investigations, provides guidance, and practical advice</li><li>Provides thought leadership on the design, and implementation of new detection strategies</li><li>Stays relevant with cyber security threats, counter measures and associated technologies</li><li>Participate in an on-call rotation to provide 24X7X365 client incident coverage</li><li>Identify opportunities to position additive professional and managed services to clients</li></ul>
<h3>Qualifications for Success:</h3>
<ul>
<li>Minimum of Bachelor's Degree in computer science, telecommunications management, electrical engineering, or a related field or have 5+ years of experience with broad background in Cyber Security specifically relating to digital forensics and response.</li><li>Minimum of 3 years of direct experience in digital forensics and incident response</li><li>Dynamic team member able to manage multiple projects simultaneously</li><li>Highly capable communicator able to relate technical concepts to business stakeholders</li><li>Advanced cyber certifications including GCIH, CISSP, CISA, CEH, ECIH and/or technology-specific certifications such as MCSE, CCNA are preferred</li><li>Skills:</li><li>Conversant in many areas of cyber security and learns new concepts quickly</li><li>Proven subject matter ability in relevant areas, such as incident response, intrusion analysis, incident handling, malware analysis (including network attack vectors and YARA RegEx), web security or security engineering</li><li>Strong working knowledge of common security tools, such as a SIEM, AV, scanners, proxies, WAF (policies rules, process and workflow), netflow, IDS or forensics tools</li><li>Strong interpersonal and leadership skills when building credibility as a peer as well as in presenting analytical data effectively to varied (including executive) audiences</li><li>Strong understanding of the cyber kill chain, attacker tactics, techniques, and procedures, and the MITRE ATT&amp;CK Framework</li><li>Strong understanding of cloud technologies and related security best practices. Experience handling security incidents in the cloud.</li><li>Firm understanding of endpoint and network-based security solutions, including EDR, firewalls, proxies and email security gateways</li><li>A solid grasp of networking and core Internet protocols (e.g. TCP/IP, DNS, SMTP, HTTP, SMB, and distributed networks)</li><li>Proficient in network forensics including PCAP analysis, network security, and IDS/IPS analysis</li><li>Able to recognize common attack vectors such as recon scans, botnet, malware, command and control activity (C2), worms, trojans, and viruses</li><li>Experience with common operating systems, such as Linux, both from a forensic and threat hunting point of view.</li><li>Strong understanding of relevant laws and regulations (e.g. HIPAA, CCPA, GDPR, PCI, etc) as related to cyber incident handling and remediation</li><li>#LI-CS1</li></ul>In addition to a career in the challenging world of cyber security, Avertium offers competitive salaries, full benefits, unlimited paid time off, participation in 401(k), and opportunities for professional growth and development. We offer the opportunity to work with cutting-edge security technologies in a stimulating work environment.Avertium provides equal employment opportunities to all employees and applicants for employment and prohibits discrimination and harassment of any type without regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state or local laws. This policy applies to all terms and conditions of employment, including recruiting, hiring, placement, promotion, termination, layoff, recall, transfer, leaves of absence, compensation and training.

United States

Digital Forensics &amp; Incident Response Consultant | Remote, USA

Job Description: 
XOR Security is actively seeking a Digital Forensics Incident Response (DFIR) Analyst to enable our operational counterparts advanced analytics support to promote the rapid analysis of national level cyber threats and incidents.  The ideal candidate will provide technical support of a 24x7 cyber program in the areas of incident  response,  insider  threat  investigations, forensics, cyber threats and information security. 
Corporate duties such as solution/proposal development, corporate culture development, mentoring employees, supporting recruiting efforts, will also be required.  
Position is contingent on successfully completing a program-based background investigation. 
Required Qualifications: 
<ul>
<li>Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering. </li>
<li>Active CISSP. </li>
<li>One or more of the following certifications: GCIA, GCIH, GCFA, GCED, or other Information Assurance Technician (IAT) Level III certification (CASP+ CE, CCNP Security, CISA, CCSP). </li>
<li>Demonstrated understanding  of  incident  response,  insider  threat  investigations, forensics, cyber threats and information security.  </li>
</ul>
<ul>
<li>A minimum of seven (7) years of professional experience with a solid understanding of incident response, insider threat investigations, forensics, cyber threats and information security.  </li>
<li>A minimum of five (5) years of hands-on experience with experience in the last two (2) years that includes host-based and network-based security monitoring, identifying and analyzing anomalous activities with familiarity in insider threat monitoring software, host- based forensic tools, intrusion detection systems, intrusion analysis functions, security information event management (SIEM) platforms, endpoint threat detection tools, security operations ticket management.  </li>
<li>Experience creating insider threat focused dashboards, reports and workflow diagrams.   </li>
<li>Experience  collecting  data  and  reporting  results;  handling  and escalating  security  issues  or  emergency  situations  appropriately;  providing incident  response  capabilities  to  isolate  and  mitigate  threats  to  maintain confidentiality, integrity, and availability for protected data.  </li>
<li>Experience with ad-hoc training to junior, mid, senior members of a cyber work force in a collaborative environment. </li>
</ul>
<ul>
<li>Subject matter expert in the field of digital media exploitation or forensics. </li>
<li>Existing Subject Matter Expertise of Advanced Persistent Threat or Emerging Threats. </li>
<li>Proficiency in utilizing various packet capture (PCAP) applications/engines and in the analysis of PCAP data. </li>
<li>Ability to work on-call during critical incidents or to support coverage requirements (including weekends and holidays when required). </li>
<li>Experience supporting a SOC program in incident response tools and techniques, specifically with forensics tools such as EnCase, Forensic Toolkit, etc. </li>
</ul>
<ul>
<li>Experience with static and dynamic malware analysis, including reverse engineering of binaries. </li>
<li>Familiarity with coding, scripting languages (BASH, Powershell, Python, PERL, RUBY etc.) or software development frameworks (.NET). </li>
<li>Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms, Data Loss Prevention (DLP) systems, and log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk or ArcSight). </li>
<li>Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts. </li>
<li>Understanding of hardware configurations and comfort with disassembling and reassembling computers and periphery devices. </li>
</ul>
<ul>
<li>Expert understanding of computer file systems, hard drive architecture and connection types. </li>
<li>In-depth experience with file system forensics, registry analysis, Internet history analysis, steganography and encryption detection and analysis, forensic media imaging, timeline analysis, email analysis, signature/hash analysis. </li>
<li>Ability and experience extracting and managing complex large data sets.  </li>
<li>Strong documentation and written communication skills with technical report writing experience </li>
</ul>
Desired Qualifications: 
<ul>
<li>Experience managing a technical team </li>
<li>Advanced troubleshooting skills </li>
<li>Hard drive and/or cellular phone repair skills </li>
<li>Forensic tool and script development </li>
<li>Metadata extraction and analysis </li>
</ul>
<ul>
<li>Network and intrusion analysis </li>
<li>Mobile/Cellular device analysis </li>
<li>Forensic video analysis </li>
<li>Digital forensic instructor </li>
<li>Software development </li>
</ul>
<ul>
<li>Database analysis/development </li>
<li>Reverse engineering </li>
<li>Application analysis </li>
<li>Network forensics </li>
<li>Intrusion analysis </li>
</ul>
<ul>
<li>Intelligence analysis </li>
<li>Social networking analysis </li>
<li>Law enforcement investigation </li>
<li>Finished intelligence report writing </li>
</ul>
Closing Statement: 
XOR Security offers a very competitive benefits package including paid health insurance coverage from first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits. 
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V. 
Citizenship Clearance Requirement Applicants selected may be subject to a government security investigation - Applicants must meet eligibility requirements – US CITIZENSHIP.

Alexandria

Digital Forensics Incident Response (DFIR) Analyst

Job Description:
XOR Security is currently seeking a talented and ambitious self-starting , Cloud SOC (Security Operations Center) Analyst for a challenging position supporting one of our premier clients who is performing a lift and shift to the Azure cloud. This is a unique opportunity for the right candidate to embed themselves into the next generation of operational environments which is now taking place across the US government. The existing team is a multi-faceted interdisciplinary set of experts with ever-increasing prowess in this unique environment. Our security operations project is aimed at establishing innovative techniques for a comprehensive, cloud-first network enclave defense, identifying the emerging threats, and detecting malicious activity using advanced toolsets provided in the Microsoft cloud security ecosystem. 
The ideal candidate will have hands-on experience as a SOC analyst performing Incident Response and Intrusion Detection on an operational Federal network, ideally having been migrated to a cloud environment, specifically, the Microsoft Sentinel SIEM and related security portals in Azure.  The candidate will monitor and analyze network traffic in these and other traditional network security toolsets, sign-ins, application endpoints and data lakes for security events, reporting any findings to Level II analysts and the SOC Lead.  The candidate will perform incident response to investigate and resolve security incidents which present themselves as alarms and those incidents which are a product of proactive investigations.  The candidate will be able to determine between false and true positives events, prioritizing them appropriately and ferrying them through the approved process from beginning to end.  Additionally, the candidate will perform, or review, root cause analysis efforts following incident recovery.  The candidate will compose security alert notifications and other communications on behalf of the SOC.
In addition, the candidate will remain up to date with current vulnerabilities, attacks, and countermeasures and develop follow-up action plans to resolve reportable issues and communicate with the other technologists to address security threats and incidents.  Also, the candidate will continually develop new use cases for automation and tuning of security tools, define and create privacy and security reportable issues metrics and reports.  The candidate will need to contribute to security strategy and security posture by identifying security gaps, evaluating and implementing enhancements.  The ideal candidate will possess a strong technical understanding of log and monitoring management systems, security event monitoring systems, network-based and host-based intrusion detection systems, security system technologies, malware detection and enterprise-level antivirus solutions/systems, VPN technologies and encryptions standards.
Location:
Washington D.C., USA
Skills and Qualifications:
Required Qualifications:
<ul>
<li>An industry technical certification such as GCIH, MS-SC200 or equivalent</li>
<li>Experience with tools such as Active Directory, Azure Active Directory, AD Connect, SAML, Kerberos, Cisco IOS, MS Server, Azure cloud environments, Incident Handling, Threat hunting experience, fundamental knowledge of IEEE 7 layers</li>
<li>Experience with deployment and documentation of enterprise project management and change management processes</li>
<li>Ability to identify solutions to potential network issues/embrace network simplification and strengthened security</li>
<li>Ability to conduct event triage and analysis and incident investigation</li>
<li>Write threat reports and incident reports</li>
<li>Read and ingest various govt. regulations for application to agency environment</li>
<li>One to two  (1-2) years of experience in network defense environments</li>
</ul>
Desired Qualifications:
<ul>
<li>Understanding of command line scripting and implementation (e.g., Python, Powershell)</li>
<li>Ability to write latest content/searches/scripts (e.g., Create dashboards, Sentinel alerts, , Python scripts, Powershell scripts)</li>
<li>Familiarity with differences in on-prem OPSEC in relation to cloud-based security</li>
<li>Strong understanding of networking (TCP Flags, TCP Handshake, IP addressing, Firewalls, Proxy, IDS, IPS)</li>
<li>Ability to perform Netflow / packet capture (PCAP) analysis</li>
<li>Experience with cyber threat hunting</li>
<li>Bachelor’s Degree in Computer Science, Computer Engineering, Information Systems or equivalent experience</li>
</ul>
Closing Statement:
XOR Security offers a very competitive benefits package including health insurance coverage from the first day of employment, 401k with a vested company match, vacation, and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance RequirementApplicants selected may be subject to a government security investigation and must meet eligibility requirements - US CITIZENSHIP and PUBLIC TRUST CLEARANCE REQUIRED.

Cloud Cyber Security Analyst

XOR Security is currently seeking several Cyber Hunt SME to support an Agency-level SOC at DHS. The SOC program provides comprehensive Computer Network Defense and Response support through 24×7×365 monitoring and analysis of potential threat activity targeting the enterprise.  Senior SOC analysts will conduct security event monitoring, advanced analytics and response activities in support of the CND operational mission.  The positions will respectively focus on Cyber Hunt, Detective Content Development, Malware Analysis, and Cyber Threat Intelligence (skills in more than one cyber discipline are preferred).  To support this vital mission, XOR staff are on the forefront of providing Advanced CND Operations, and Systems Engineering support to include the development of advanced analytics and countermeasures to protect critical assets from hostile adversaries.
To ensure the integrity, security and resiliency of critical operations, we are seeking candidates with diverse backgrounds in cyber security systems operations, analysis and incident response. Strong written and verbal communications skills are a must. The ideal candidate will have a solid understanding of cyber threats and information security in the domains of TTP’s, Threat Actors, Campaigns, and Observables. Additionally the ideal candidate would be familiar with intrusion detection systems, intrusion analysis, security information event management platforms, endpoint threat detection tools, and security operations ticket management.
Candidate must have the required Qualifications:
<ul>
<li>For a Senior, at least 5 years of experience in a cyber network defense environment.</li>
<li>Active top Secret and/or DHS Agency Clearance.</li>
<li>Strong analytical and technical skills in computer network defense operations, ability to lead efforts in Incident Handling (Detection, Analysis, Triage), Hunting (anomalous pattern detection and content management) and Malware Analysis.</li>
<li>Prior experience and ability to with analyzing information technology security events to discern events that qualify as a legitimate security incidents as opposed to non-incidents. This includes security event triage, incident investigation, implementing countermeasures, and conducting incident response.</li>
<li>Previous hands-on experience with a Security Information and Event Monitoring (SIEM) platforms and log management systems that perform log collection, analysis, correlation, and alerting is required (preferably within Splunk or ArcSight).</li>
<li>Ability to develop rules, filters, views, signatures, countermeasures and operationally relevant applications and scripts to support analysis and detection efforts.</li>
<li>Strong logical/critical thinking abilities, especially analyzing security events (windows event logs, Tanium queries, network traffic, IDS events for malicious intent).</li>
<li>Strong proficiency Report writing – a technical writing sample and technical editing test will be required if the candidate has no prior published intelligence analysis reporting, excellent verbal and written communications skills and ability produce clear and thorough security incident reports and briefings.</li>
<li>Excellent organizational and attention to details in tracking activities within various Security Operation workflows.</li>
<li>A working knowledge of the various operating systems (e.g. Windows, OS X, Linux, etc.) commonly deployed in enterprise networks, a conceptual understanding of Windows Active Directory is also required, and a working knowledge of network communications and routing protocols (e.g. TCP, UDP, ICMP, BGP, MPLS, etc.) and common internet applications and standards (e.g. SMTP, DNS, DHCP, SQL, HTTP, HTTPS, etc.).</li>
<li>Experience with the identification and implementation of counter-measures or mitigating controls for deployment and implementation in the enterprise network environment.</li>
<li>Experience in mentoring and training junior and mid-level analysts. </li>
</ul>
Desired Qualifications:
<ul>
<li>Bachelor’s Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering, or Electrical Engineering.</li>
<li>One or more certifications for CND Analysts:  GCIA, GCED, GCFE, GCTI, GNFA, GCIH, CND, ECSA, OSCP, OSEE, OSCE.</li>
<li>One or more certifications for malware or forensic analysts:  GCFA, GCFE, GREM, CHFI.</li>
<li>Existing Subject Matter Expertise of Advanced Persistent Threat or Emerging Threats.</li>
<li>Expertise on policies, industry trends, techniques related to penetration testing.</li>
<li>Proficiency in utilizing various packet capture (PCAP) applications/engines and in the analysis of PCAP data.</li>
<li>Experience with one or more of the following technologies Network Threat Hunting (Sqrrl), Big Data Analytics (Splunk), Endpoint Threat Detection (Tanium), SIEM (ArcSight), workflow and ticketing (HP Service Manager), Intrusion Detection System (IBM ISS).</li>
<li>Ability to work on-call during critical incidents or to support coverage requirements (including weekends and holidays when required).</li>
<li>Familiarity with scripting languages (BASH, Powershell, Python, PERL, RUBY etc.) or software development frameworks (.NET).</li>
</ul>
Closing Statement:
XOR Security offers a very competitive benefits package including health insurance coverage from the first day of employment, 401k with a vested company match, vacation and supplemental insurance benefits.
XOR Security is an Equal Opportunity Employer (EOE). M/F/D/V.
Citizenship Clearance Requirement
Applicants selected may be subject to a government security investigation and must meet eligibility requirements - US CITIZENSHIP and TOP SECRET CLEARANCE REQUIRED!

Springfield

Cyber Hunt SME

Apply to PCAP Cyber Security Jobs in companies remotely and near you. New PCAP Cyber Security Jobs added daily.

Job Position and Company	Location	Tags	Posted
Mid Level SOC Analyst at XOR Security	Full Time Soc Analyst Analyst Incident Response Active Directory
Digital Forensics & Incident Response Consultant \| Remote, USA at Avertium	Remote Full Time Forensic Consultant Incident Response
Digital Forensics Incident Response (DFIR) Analyst at XOR Security	Full Time Forensic CCSP Analyst Incident Response
Cloud Cyber Security Analyst at XOR Security	Active Directory Automation Azure C Clearance
Cyber Hunt SME at XOR Security	Active Directory Analytics Arcsight BASH Big Data

PCAP Cyber Security Jobs

0 PCAP Cyber Security Jobs. Page 1 of 1

5 closed pcap cyber security jobs:

Subscribe to the weekly
Cyber Security Jobs Newsletter

PCAP Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

PCAP Cyber Security Jobs

0 PCAP Cyber Security Jobs. Page 1 of 1

5 closed pcap cyber security jobs:

Subscribe to the weekly Cyber Security Jobs Newsletter

PCAP Cyber Security Jobs

All Cyber Security Jobs

Cyber Security Jobs by Category

Subscribe to the weekly
Cyber Security Jobs Newsletter