About the role
You will be reporting on technical subject matter such as malware developments, offensive security tools, vulnerability exploits, cloud security, and mobile security. Cyber Threat Analysts are expected to familiarize themselves with these topics continuously, identifying threat leads from a variety of sources. Cyber Threat Analysts are also expected to analyze malware and create effective detections, which their senior peers will review and validate. Cyber Threat Analysts must be able to communicate this subject matter effectively to various audiences, both verbally and in writing.
Specific Duties and Responsibilities:
Threat Lead Identification: Research new adversary tactics, techniques, and procedures (TTPs) using open sources (public information such as security vendor reporting, social media, code repositories); closed sources (dark web and underground forums); and proprietary sources.
Subject Matter: Threat leads should focus on team priority intelligence requirements (PIRs). Examples of such subject matter include malware developments, offensive security tools, vulnerability exploits, cloud security, and mobile security.
Key Detail Identification: During research, identify and take note of infection chains, host and network IoCs, malware samples, threat actors, and MITRE ATT&CK tactics and techniques
Author Insikt Notes: Write TTP Instances detailing identified threat leads. TTP Instances include a combination of information from open-source reporting and your own analysis (i.e. code review, static malware analysis). TTP Instances are written and formatted to help our customers understand infection chains while also helping them prepare and validate their defenses.
Cadence: Write at least 2 TTP Instance notes daily.
Quality: Authored TTP Instances should include minimal grammatical or syntax errors. Plagiarism is not acceptable.
Malware Analysis: Using sandbox environments and static analysis tools, analyze malware samples associated with threat leads.
Use Cases: Malware analysis is used to provide additional insight into an event, validate open-source reporting, uncover additional IoCs, and assist peers and customers in detection engineering.
Detection Engineering: Create malware or vulnerability detections (e.g. YARA, Sigma, Snort, Nuclei) that can be used for threat hunting, detection, and classification.
Cadence: Create at least 1 malware or vulnerability detection per month
Delivery: In most cases, these detections will be delivered alongside a TTP Instance.
Information Security: Adhere to and implement quality and information security policies and carry out its processes and procedures accordingly.
Required Skills:
Strong written communication in English
Demonstrable experience writing reports on technical subject matter (e.g. malware,
vulnerability exploits, offensive security tools) in a clear, concise, and logical format
Disciplined time management
Self-starting, self-motivated, and thrive in a collaborative environment
Ability to receive and apply constructive feedback from peers and leadership
Minimum Qualifications:
B.S. equivalent in computer science, information systems, or cyber intelligence
At least one (1) year professional experience, Malware Analysis & Technical Writing
Technical proficiency in Cyber Threat Intelligence and Threat Intelligence Platforms
Experience working with open-source intelligence (OSINT) and/or large data sets
Experience working with sandboxes, virtual machines, or other malware analysis
tools
Familiarity with the MITRE ATT&CK Framework, including the ability map reported
activity to ATT&CK tactics and techniques
Familiarity with interpreting and mapping cyberattacks to the Diamond Model of
Intrusion Analysis
Adeptness in cybersecurity and data protection
Good-To-Have Skills:
Proficiency in scripting or programming languages (PHP, C, C#, C++, Python, PowerShell, Go, JavaScript, Rust)
Experience creating malware detections (e.g. YARA, Sigma, Snort)
Experience creating vulnerability detections (e.g. Nuclei)
Originally posted on Himalayas