What you'll doWe are thrilled to announce an exciting opportunity for a Security Specialist to join our dynamic team in Carlsbad, CA! This hybrid role offers the unique blend of working collaboratively within our Carlsbad office and the flexibility of remote work.
The Security Specialist will form part of the global 24 x7 security team that monitors the network for suspicious activity and supports incident response activities. All of Viasat's networks are covered by this group, including those supporting the US government, as well as commercial interests. This role combines portions of traditional Tier I/II/III SOC responsibilities to include alert triaging, detailed incident handling across online and on-premise infrastructure, following an incident response process to contain & mitigate security risks, and supporting threat hunting activities.
Your mission is to perform:
- Security Monitoring: review alerts within SIEM/SOAR platforms and manage security cases & tickets, conduct initial security incident analysis to ensure timely response.
- Incident Response: drive the entire incident response lifecycle from initial triage and in-depth investigation to rapid containment and effective remediation of active security threats.
- Advance Detection: collaborate with Detection Engineers to rapidly develop and deploy new detections, composite rules, and dashboards based on discovered threat Tactics, Techniques, and Procedures (TTPs).
- CTI-Driven Threat Hunts: collaborate closely with the Cyber Threat Intelligence (CTI) team to analyze relevant intel, extract actionable insights, and detect potential Indicators of Compromise (IoC) associated with Advanced Persistent Threats (APTs).
The day-to-dayA typical day involves a blend of deep investigation, collaboration, and continuous learning:
- Monitoring & Triaging Alerts: security monitoring, managing security cases & tickets, security incident analysis, and other security tasks.
- Security Log Reviews: analyzing a variety of security logs to identify actionable events (SIEM reports-alerts-tickets, system, network, security monitoring tools).
- Event Analysis: determine the attack type and scope based on the triage of events collected.
- Problem Solving: use critical thinking to navigate complex problem-sets (technical and non-technical) with real-world impacts to business and stakeholders when triaging system & network events.
- Documentation: capture all investigative, response, and remediation activities within the case management platform Ensure each case includes a detailed triage, captured artifacts, and any IOCs to support clear tracking of security team efforts of associated tasks.
- Detection Tuning: provide feedback into the design, implementation, and administration of security tools/ rules to reduce false positives.
- Mitigation Support: analyze data sets, determine the gaps and recommend fixes to appropriate stakeholders.
- Reporting: document and communicate findings clearly to both technical and non-technical stakeholders, detailing the threat, its potential impact, and actionable remediation steps.
What you'll need- Experience: 2+ years of experience and training in the field of cyber security monitoring and analysis, incident response, cyber threat analysis, and vulnerability analysis.
- Incident Response Lifecycle: 1+ years of experience with the Incident Response lifecycle (Preparation, Detection & Analysis, Containment, Eradication & Recovery, Post-Incident Activity) and the ability to lead the technical aspects of an investigation.
- Education: Bachelor's degree in Information Security, Forensics, Computer Science related fields or equivalent experience.
- Certification: must possess a DoD 8140 Intermediate (or above) certification or be able to obtain one within 6 months of onboarding.
- Platform Proficiency: expertise and practical experience with Security Information and Event Management (SIEM)/ Security Orchestration, Automation & Response (SOAR) platforms and Endpoint Detection & Response (EDR) tools.
- Communication Skills: excellent verbal and written communications skills with experience producing executive-level briefs.
- Technical Deep Dive Skills: an understanding of operating system internals (Windows, macOS, Linux), common network protocols, or the ability to analyze endpoint and network artifacts (e.g., packet captures, memory dumps, system logs).
- Clearance: Active United States Secret Clearance.
What will help you on the job- Government Cloud Security: familiarity with the security logging, monitoring, and threat landscape of cloud environments that comply with US federal government security standards under NIST SP 800-53 Rev5 and NIST SP 800-37.
- Specialized Certification/ Training: a Global Information Assurance Certification (GIAC) Certified Incident Handler (GCIH), GIAC Certified Intrusion Analyst (GCIA), GIAC Penetration Tester (GPEN) or GIAC equivalent.
- Threat-Intel Collaboration: ability to analyze and apply Cyber Threat Intelligence to hunting for adversary TTPs.
- Growth-mindset: willingness to learn new skills and new tools.
- Team Spirit: Excel in a collaborative environment, actively contributing to a positive team culture by fostering continuous learning, sharing knowledge, and working seamlessly with peers to achieve shared security objectives.
Salary range$121,000.00 - $191,000.00 / annually.For specific work locations within San Jose, the San Francisco Bay area and New York City metropolitan area, the base pay range for this role is $150,000.00- $225,000.00/ annually
At Viasat, we consider many factors when it comes to compensation, including the scope of the position as well as your background and experience. Base pay may vary depending on job-related knowledge, skills, and experience. Additional cash or stock incentives may be provided as part of the compensation package, in addition to a range of medical, financial, and/or other benefits, dependent on the position offered. Learn more about Viasat's comprehensive benefit offerings that are focused on your holistic health and wellness at https://careers.viasat.com/benefits.
