Tech Stack
AzureCloudCyber SecurityDNSLinuxMacOSPythonSMTPTCP/IP
About the role
- Resetting user passwords for cause (e.g., when they have been identified as being suspected compromised or 'known compromised')
- Working with service owners to reset service account passwords for various reasons
- Ensuring authorizers are designated for in-scope accounts
- Analyzing usage patterns for accounts to identify inactive accounts or inappropriate account use
- Reviewing approval requests for various new access or accounts
- Triaging unusual access requests or phishing reports
- Evaluate EDR installation and coverage and identify systems without EDR for remediation
- Monitoring external attack surface for unapproved systems, undocumented systems, and newly disclosed vulnerabilities
- Reviewing systems with existing public access to ensure requirements are followed (e.g., event logging, multifactor authentication)
- Attend online/Teams meetings; provide status, suggest improvements, discuss implementation
- Analyze data and perform initial planning to address identified issues
- Assist with creation of playbooks and execute playbooks with minimal assistance
- Conduct proactive threat hunts and lead investigations end-to-end as an advanced responsibility
Requirements
- 1–3 years in a SOC, cyber security 'blue team', or closely related role
- Strong grasp of TCP/IP, OSI model, and common protocols (HTTP, DNS, SMTP)
- Windows/Linux/macOS fundamentals; Active Directory/Azure AD concepts; basic cloud logging
- Experience with at least one SIEM and one EDR/XDR platform
- Experience with ticketing/case management
- Ability to craft queries using common languages; comfort with regex, JSON and APIs; basic scripting in Python/PowerShell/Bash
- Excellent analytical, problem-solving, and communication skills
- Must be a U.S. citizen
- Successful drug screening
- Ability to qualify for HSPD-12 card for use in two-factor authentication