Responsibilities

• Conductday-to-day Incident Response activities as well asadditionalSOC related detection and response activities asrequiredfor a global environment

• Design, engineer, and implement runbooks and playbooks forIncidentResponse

• Coordinate with both technical and business stakeholders during the incident response process.

• Perform host based,cloud based,network based, memory, or log analysis and/or forensics in support ofIncidentResponse investigations.

• Play an active role in CAAsSecurityIncidentResponse efforts, working toidentifyand mitigate information securitythreats

• Reviewsecurity information,event logs,and reports, provide findings and recommendations

• Use input from IRM leadership and key security metrics to ensure technical security controls are meeting desiredobjectives; implement a process of continualreview and improvement to ensure the measurable effectiveness of CAAs technicalcontrols

• Other projects or duties asassigned, including periodicon-call

Required Capabilities

• Aminimum of3years in Information Technology, ideallywith2yearsexperiencein ahands-onIncidentResponse,ThreatHunting, or forensics role

• Abachelors or mastersdegree in a relevant field of work

• Strong technical background with experience in at leasttwoof the following

• Windows disk and memory forensics

• Network traffic analysis (netflow,pcap)

• Log Analysis

• Unix or Linux disk and memory forensics

• Malware analysis both static and dynamic

• Astrong understanding of the fundamental operations of servers, operating systems, networks,firewalls,cloud applications,and infrastructure

• Expertisebuilding workflows and playbooks tofacilitatetheIncidentResponseprocess

• an understanding of the NIST framework and using a continuous improvement loop

• has built and managed frameworks to test andvalidatethe effective operation of security controls; measuring the ability torespond tothreats and attacks at the earliest point in the kill chain.

Environment

CAA has aservice orientedcollaborative environment where we help ourcolleaguesthen focus on our own work.