text: Incident Response Analyst 2 | Irving, TX
  Incident Response Analyst 2
  As an Incident Response Analyst, you will be given the opportunity to work with a team of security analysts to detect, analyze, and mitigate potential intrusions and other security incidents. Candidates must be willing to work in a CSIRT environment, demonstrate strong problem solving skills, have experience in various toolsets and best practices, able to critically think, and allow for flexible scheduling.
  •Shift is 8:00AM-5:00PM, Monday-Friday (Flexible schedule timing)
  •Investigates, analyzes, host and network data to respond to cyber incidents within the network and cloud environment.
  •Coordinate and provide technical support to enterprise-wide information technology teams to resolve cybersecurity incidents.
  •Correlate incident data to identify specific compromises and make recommendations that enable expeditious remediation
  •Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible threats to network security.
  •Perform cybersecurity defense incident triage, to include determining scope, urgency, and potential impact; identify a compromised endpoint; and make recommendations that enable expeditious remediation
  •Perform collection of forensic artifacts and inspect to discern possible mitigation/remediation on enterprise systems
  •Perform real-time cyber defense incident handling (e.g., forensic analysis, intrusion correlation and tracking, threat analysis, and direct system remediation).
  •Receive and analyze alerts from various sources within the enterprise and determine root cause of such alerts.
  •Track and document cyber defense incidents from initial detection through final resolution.
  •Employ approved defense-in-depth principles to remediate active threats (e.g., defense-in-multiple places, layered defenses, security robustness).
  •Collect intrusion artifacts from network sources and use data to enable mitigation of potential cyber defense incidents within the enterprise.
  •Perform malware analysis on malicious files to gather indicators of compromise.
  •Participate in Threat hunting exercises
  •Write and publish reports of an investigation.
  •Perform log analysis within a log aggregator to timeline an event.
  •Requires 2 years of related experience.
  •Strong communication and customer interaction skills.
  •Associate's or Bachelor's degree in a computer science preferred.
  •Experience with a log aggregation query language.
  •Experience with conducting host analysis and obtaining indicators of compromise on Windows, Linux, and Mac operating systems.
  •Knowledge of cyber threats and vulnerabilities.
  •Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions.
  •Experience with network traffic analysis methods.
  •Experience with malware analysis concepts and methodologies.
  •Some experience with programming and scripting techniques.
  •Experience in obtaining artifacts from network logs regarding malware (C2 Beaconing, Exfiltration, Phishing)
  •Basic understanding in obtaining host based artifacts regarding malware on Windows, Linux systems.
  •Basic understanding in using security event correlation tools. (SIEM Technologies and Log Aggregators)
  •Ability to perform forensic analysis of host and network-based intrusions using intrusion detection technologies