Senior Security Analyst
Senior Security Analyst on Bitdefender's Managed Detection & Response team: works 24/7 shifts (four 10-hour rotations incl. weekends), proactively hunts threats across customer environments, serves as escalation point, leads incident response, and develops analytic detection signatures. Core tech: SIEM, packet analysis (Wireshark/tcpdump), log analysis, Windows/Unix/Linux.
- Compensation
- Not disclosed
- Location
- San Antonio
- Work setup
- Not specified
- Seniority
- Senior
- Employment
- Full time
- Experience
- 18+ years
- Category
- Security
- Posted
Skills
Must have
- Ability to work full-time in a 24/7 operation on a four 10-hour shift schedule, including required weekend rotations
- Working knowledge of cybersecurity principles
- Knowledge of cyber threats and vulnerabilities
- Knowledge of current incident response methodologies
- Knowledge of current cyber investigative techniques
- Knowledge of current cyber threat trends
- Computer networking concepts and protocols, and network security methodologies
- Knowledge of basic physical computer components and architectures (CPUs, NICs, HDDs)
- Ability to analyze log files from a variety of sources (host, network traffic, firewall, IDS) to identify threats
- Basic system administration, network, and operating system hardening techniques
- Identifying, modifying, and manipulating system components within Windows, Unix, or Linux
- Research, analysis, and correlation across a wide variety of all-source data sets
- Defense-in-depth principles and practices
- Knowledge of virtualization and cloud computing
- Knowledge of which system files (log, registry, configuration) contain relevant information
- Knowledge of hacking methodologies
- Knowledge of networking protocols (TCP/IP), services (web, mail, DNS), and how they interact
- Knowledge of encryption algorithms (IPSEC, AES, GRE, IKE, MD5, SHA) and their use
- Ability to perform packet-level analysis using tools such as Wireshark and tcpdump
- Experience with SIEM tools for searching, aggregating, and correlating data
- Knowledge of Web Application Firewalls (WAF)
- Knowledge of Regular Expressions (Regex)
- Serve as an escalation point for security events from multiple sources
- Proactively review customer environments for anomalous behavior using Cyber Kill Chain, IOCs/IOAs, and intelligence
- Lead an Incident Response Team to investigate and remediate active threats with proper documentation
- Develop analytic signatures to identify suspicious and malicious behaviors
Full description
Bitdefender is a cybersecurity leader delivering best-in-class threat prevention, detection, and response solutions worldwide. Guardian over millions of consumer, enterprise, and government environments, Bitdefender is one of the industry’s most trusted experts for eliminating threats, protecting privacy, digital identity and data, and enabling cyber resilience. With deep investments in research and development, Bitdefender Labs discovers hundreds of new threats each minute and validates billions of threat queries daily. The company has pioneered breakthrough innovations in antimalware, IoT security, behavioral analytics, and artificial intelligence and its technology is licensed by more than 180 of the world’s most recognized technology brands. Founded in 2001, Bitdefender has customers in 170+ countries with offices around the world. For more information, visit https://www.bitdefender.com
Senior Security Analyst - Managed Detection and Response
Our mission at Bitdefender is to reduce risk to customers’ business to allow them to achieve their objectives. We are focused on delivering real security value for an affordable price – no snake oil. To help in this mission, we are looking for a Senior Security Analyst. You will work in a tight knit, experienced team backed up by an international organization that’s been in business for 18 years.
About Us
The Managed Detection & Response service is a new line of business (think division, business unit, etc). We are an experienced team having built successful Managed Security offerings in the past and staffed by a multitude of cybersecurity organizations and veteran cyber-warfare operators from the military and intelligence services. We all got into this business to provide security services that make customers safer. We must make some money to do that, but our primary goal is to provide services that secure, not just ones that sell.
Our team has been around the block together and operate in a 24x7 environment where we manage emergency situations for customers. For this to work, we must trust each other. As a leadership team, we focus on building that trust through accountability, processes and personal relationships. We have plenty of experienced team members with and without families and understand that not all teams can be built outside of work, but we focus on teamwork to build authentic and meaningful engagement.
About the Role
- This is a full-time position in a 24/7 operation with a four 10-hour shifting schedule. Scheduled rotations for weekend shifts will be required
- Serve as an escalation point for security events from multiple sources
- Using the Cyber Kill Chain, indicators of activity and indicators of compromise with current intelligence information to proactively review customers environments searching for anomalous behavior across network, host and logs data