Threat Hunter/Analyst

Responsibilities

As an individual contributor in our Security Operations Center, you’ll have a broad list of responsibilities including: (the mix will depend on your interests and skill-level)

• Threat Hunting, to proactively detect, isolate, and neutralize threats:
• Research traffic on our networks, create baselines for expected norms and identify and investigate outliers. Provide your analysis and document your research.
• With your understanding of normal operations and your baseline for logging and events, hunt for anomalous events and pull the thread to determine if our systems were compromised or a compromise was attempted.
• Manage research related to threat hunting adversaries in our environments
• Participate in investigations related to threat hunting adversaries in our environments
• Monitoring:
• Monitor and analyze the output from many log sources including cloud services, on-premise network equipment, productions platforms, and employee provided devices and recommend security actions per procedures where required
• Perform Real-Time monitoring and triaging of security alerts
• Incident Response:
• Act as the first point of contact (POC) for security incidents and anomalies
• Coordinate with other security and operations teams during incidents or investigations
• Conduct preliminary incident triage according to the Security Incident Management Triage Matrix and set the priority accordingly
• React and respond to all real or perceived security and cyber-related incidents, threat and attacks within agreed times
• Determine and classify the severity of alerts and assess potential impacts as classification defined in the knowledge base
• Stay on the bleeding edge by conducting research, consulting with colleagues and attending training to maintain awareness of trends in new security threats, technologies, and regulations
• Assist in IT security investigations, red team exercises and penetration tests as needed
• Understand and operates an effective Security Orchestration, Automation and Response (SOAR) platform
• Work closely with other teams to provide mitigation recommendations to reduce the overall security risk within the organization
• Provide ideas and feedback to improve the overall SOC capabilities and maturity
• Find and analyze various threat intelligence feeds
• The position is on-call through an on-call schedule and PagerDuty.

Required Skills

• Understanding of concepts such as MITRE ATT&CK and the Cyber Kill Chain
• Operating knowledge of:
• SIEM solutions such as Sumo Logic, Splunk or Elastic SIEM
• Analyzing and triaging security logs from Windows, Linux, ChromeOS, and macOS
• Managing and prioritizing security events
• Understanding various types of log sources and how to use them to build a full picture
• TCP/IP Networking and understanding of other major protocols

What we offer

• Challenging work in a fun and collaborative environment
• Attractive compensation and time-off benefits
• Full-time employment with flexible working hours
• Multicultural teams represented by 30+ nationalities
• Reports initially to the Cybersecurity Manager and then to the Lead Threat Hunter/Analyst

Note: Please do not include any salary or compensation information on your resume

Hiring process

When it comes to hiring processes, “rigorous” and “opaque” are often mistakenly conflated. For us, it’s always a mutual exchange, so we think it’s important that candidates have a clear understanding of the process and what we’re looking for. Learn more about the hiring process by visiting our careers page.

Benefits

Health and happiness go hand in hand, and we make every effort to support our team members in all facets of their lives—both inside and outside the office. Learn more about our employee benefits by visiting our careers page.

Before you apply

• At the moment, we do not sponsor visas in the UK and the EU. For Hong Kong, we require at least two years of working experience and a university degree in a related field. For Singapore, we can only sponsor visas for mid-career or above.
• Please upload your resume as a PDF and do not include any salary or compensation information in it.

ExpressVPN is one of the world’s leading providers of online privacy and security services for consumers. Started in 2009, we’ve grown to have millions of active paying customers, a team of more than 700 people worldwide, and a brand recognized by hundreds of millions of people in 18 languages and more than a hundred countries. We see huge growth in our industry, and are gaining market share through strong execution.