Sr. Information Security - Threat Research & Detection Engineer - US Bank (Arkansas)
This position will require extensive knowledge of the security space as it relates to technology, social, and cyber threats. Through day to day work this team will inherently conduct threat hunting and uncover cyber adversaries attempting to infiltrate our network. Candidate needs to be able to identify the necessary actions required to investigate and contain threats and have a proactive computer network defense mindset which they use to develop comprehensive detection strategies and provide technical guidance to the Security Operations Center and Incident Responders.
This is a high visibility and at times high stress position that will challenge the candidate to innovate advanced detection signatures by utilizing, and enhancing, the MITRE ATT&CK framework. Actions taken by this individual impact the security and functionality of the enterprise IT for the entire bank.
**Responsibilities**
Threat Research
• Analyze threats and vulnerabilities to determine their impact to U.S. Bancorp’s operations.
• Proactively research emerging cyber threats.
• Proficient in the use of virtual environments to contain malicious files and activity.
• Exhaust detections for adversary tactics by uncovering previously unknown techniques.
Detection
• Develop and contribute to the enterprise threat detection library.
• Develop and maintain standard operating procedure (SOP) documentation.
• Understand the threat actor’s Tactics, Techniques and Procedures
Support
• Provide requirements and strategy for security detection tools.
• Assist in post-mortem evaluations on cyber security incidents.
• Complete implementation requests for detections submitted by the incident response team, security operations center, and management.
• Candidates must be well versed in common network scanning tools that support network discovery, compliance reporting, and vulnerability assessment.
Professional
• Establish and maintain cohesive working relationships with team members, management, key strategic business partners, and vendors.
• Acquires and applies expert knowledge of the business, its products and processes.
**Qualifications:**
**Basic Qualifications**
• Bachelor's degree in Engineering or Science, or equivalent work experience
• Eight or more year of experience in information security
• Two or more years of experience in IT infrastructure management, application architecture, risk management, data architecture, middleware technology, and IT operations and project management
**Skills / Experience**
• Strong analytical & evaluative thinking
• Knowledge of the MITRE PRE-ATT&CK and ATT&CK framework
• Experience working on a Red Team or working as an Incident Responder/Handler
• Demonstrated experience in developing rules to alert, prevent, and mitigate threats using network and endpoint technologies
• Experience with forensic tools and operating system internals.
• Ability to extract host and network-based IOCs to provide requirements for detection and prevention
• Ability to work nontraditional & extended working hours when necessary
• Understanding of network protocols and services
• Strong written and verbal skills with the ability to present complex concepts at high level
• Programming and scripting experience, including Python and PowerShell.
• Understanding of networking, system administration, architectures and security elements
• Experience in hardware/software operational infrastructure associated with Red Team types of “attack platforms.”
• Experience in operation of commercial and open source network cyber assessment tools.
• Experience in exploitation and vulnerabilities associated with most common operating systems (Windows, Linux, etc.), protocols (HTTP, FTP, etc.), and network security services (PKI, HTTPS, etc.).
• Experience in development, modification, and utilization of network enumeration engines, Open Source Research (OSR) engines, and reverse engineering exploitation frameworks.
• Experience in advanced hacking capabilities (e.g. botnet, client deception, Trojans, data exfiltration, mobile device discovery and exploitation).
**Job:** Information Technology
**Primary Location:** Minnesota-MN-Richfield
**Shift:** 1st - Daytime
**Average Hours Per Week:** 40
**Requisition ID:** 190001951
**Other Locations:** United States, Ohio-OH-Cincinnati
