Cybersecurity Analyst Threat Hunting

• Direct experience at L3 SOC (detective, investigative, DFIR) or Threat Hunting or Threat Management or Cyber Threat Intelligence work at multinational company, exposed to enterprise level tools
• Experience working at technology sector where innovation and fast-moving technology is in environment.
• Proactively hunt focusing on active threat actor tactics or novel new emerging threats to check for possible gaps at current detection or mitigation controls
• Ability to use public and private sources available in the CTI team to identify active threats, recent exploited vulnerabilities and novel attack techniques that may be an immediate threat that affects the company
• Conduct threat hunting using data at SIEM, EDR and other tools. Create hunting hypothesis based on intelligence trends looking for evidence of such threats and techniques.
• Able to provide course-of-action recommendations (in email or tickets) to other teams or tools at detection, blocking and other enterprise control justified by hunt findings.
• Produce hunting reports on a weekly basis, listing hunt conducted and results. Use of an industry recognized threat hunting methodology
• Work with detection engineering, to recommend converting hunt findings into new detection use cases and response SOPs that will be used by SOC for future detection and response.
• Maintain quality of IOCs used at scheduled IOC searches in security detect controls, conduct initial review to investigate IOC hits to tune false positive and false negatives. Provide summary of results and ongoingly tune IOCs.
• Identify detection gaps using MITRE ATT&CK, and trending threat actor TTPs intelligence to improve security detection and monitoring daily operations. Use industry known sig formats such as YARA, SIGMA, Snort, etc.
• Participates in the assessment, analysis, and feedback of improvements for Threat Intelligence Teams intelligence lifecycle.
• Compile operational reporting and be in rotation as a presenter in ops meetings, able to convey results and findings of hunting done. Provide metrics of IOC detects reviewed, tickets created, course of action disseminated at operational infosec meetings

Job Types: Full-time, Permanent

Pay: Up to RM13,000.00 per month

Benefits:

• Health insurance
• Opportunities for promotion
• Professional development

Schedule:

• Day shift
• Monday to Friday