[Remote] Princpl Threat Detect & Response Anlyst - 90386707 Job Details | Amtrak

Note: The job is a remote job and is open to candidates in USA. Amtrak is hiring a Principal Threat Detection & Response Analyst to support its Cyber Fusion Center’s digital forensics and cyber incident response work. The role investigates, contains, and helps remediate security incidents, while improving response processes and coordinating incident exercises and response activities with internal teams and stakeholders.

Responsibilities

• As a Principal Threat Detection & Response, you will provide industry-leading incident response supporting the Cyber Fusion Center mission to effectively detect and respond to threats and reduce the overall impact of business risk before, during, and after an incident
• You will be able to resolve security incidents quickly, effectively and at scale with complete incident response including investigation, containment to support effective remediation, and crisis management
• In this role, you will technically navigate critical and high-profile incidents, performing digital forensic and incident response analysis with support from threat hunting, and malware triage analysts
• Support Amtrak-wide cyber incident response engagements, examine cloud, endpoint, and network-based sources of evidence
• Recognize and codify attacker Tools, Tactics, and Procedures (TTPs) and Indicators of Compromise (IOCs) that can be applied to current and future investigations
• Build scripts, tools, or methodologies to enhance Amtrak’s incident investigation processes
• Conduct host forensics, network forensics, log analysis, and malware triage in support of incident response investigations
• Support Cyber Incident Exercises, Tabletops, and Cyber Incident Management Response Team with business leaders, stakeholders, and cross-functional teams
• Support with Crisis Management, Emergency Management, Incident Response, Legal and OIG teams to conduct and coordinate on Cyber Incident Response Activities
• Regularly participate in tabletop exercises designed to identify gaps, improve skills, enhance communication, and engage with stakeholders
• Review technical reports from vulnerability and penetration testing assessments, as well as results from tabletop exercise to identify potential future incidents
• Develop, refine, recommend, and maintain playbooks, policies, and procedures to ensure alignment to industry best practices

Skills

• Bachelor's degree in computer science, Information Systems, Cybersecurity, or related technical field plus 7+ years of relevant experience is required
• Experience on one or the combination of the below to satisfy education and experience requirements: + Incident Response + Vulnerability Management + Digital Forensics (i.e. Logical verses Physical Disc Imaging) + Network or Cloud Security + Penetration Testing
• One incident response centric certification: * + GIAC Certified Incident Handler (GCIH) + GIAC Response and Industrial Defense (GRID) + GIAC Battlefield Forensics and Acquisition (GBFA) + GIAC Certified Forensic Examiner (GCFE) + GIAC Advanced Smartphone Forensics + GIAC Certified Forensic Analyst (GCFA) + GIAC Network Forensic Analyst (GNFA) + GIAC Reverse Engineering Malware (GREM) + EC-Council Certified Incident Handler (E|CIH) + eLearnSecurity Incident Handling & Response Professional (IHRP) + SEI Computer Security Incident Handler (CSIH) + NICCS Certified Incident Handler Engineer (CIHE)
• In depth understanding of threats, vulnerabilities and principals of incident response and chain of custody
• Hands on experience with forensics tools and log correlation
• Ability to think like an attacker and hunt within the security tool stack
• Ability to incorporate the MITRE ATT&CK Framework in everyday processes
• Experience in cybersecurity, with a focus on threat intelligence analysis, cyber threat hunting, and incident response
• Strong technical skills and expertise in cybersecurity tools and technologies, including SIEM, EDR, threat intelligence platforms, and malware analysis tools
• In-depth knowledge of cyber threats, attack techniques, and threat actor groups, including their motivations, capabilities, and TTPs
• Experience conducting in-depth analysis of cyber threats, including malware analysis, network traffic analysis, and log analysis
• Excellent analytical and problem-solving skills, with the ability to analyze complex cyber threats and provide actionable insights and recommendations
• Strong communication and interpersonal skills, with the ability to effectively communicate technical concepts and findings to both technical and non-technical stakeholders
• Ability to work independently and collaboratively in a fast-paced environment, managing multiple tasks and priorities effectively
• * Preferred knowledge and familiarity with Operational Technology (OT), Industrial Controls Systems (ICS) or Supervisory Control and Data Acquisition (SCADA) systems but not required
• Cybersecurity certifications, courses, or hands-on experience with some of the following: + Advanced Threat Detection + Hacker tools, techniques + Penetration Testing, Exploit Writing, and Ethical Hacking + Offensive Security, Security Operations, Web Application Testing, or Cloud Security + Reverse-Malware Engineering + Digital Forensics and Incident Response + PowerShell, JavaScript and Python + Relevant certifications including GIAC Certified Incident Handler (GCIH), Certified Incident Response Handler (GCFA) or similar + Experience with using SIEM systems, network security tools, and log analysis tools + Experience with cyber incident response + Experience with Mitre ATT&CK framework + Experience with threat intelligence, vulnerability management, and security incident response
• Master's degree in Cybersecurity, Information Technology, Digital Forensics, Computer Science, or equivalent technical field
• 10+ years of experience within the cybersecurity field
• Basic knowledge of Operation Technology (OT), SCADA, HVAC and/or IoT
• Two or more incident response centric certifications: + GIAC Certified Incident Handler (GCIH) + GIAC Response and Industrial Defense (GRID) + GIAC Battlefield Forensics and Acquisition (GBFA) + GIAC Advanced Smartphone Forensics + GIAC Certified Forensic Analyst (GCFA) + GIAC Network Forensic Analyst (GNFA) + GIAC Reverse Engineering Malware (GREM) + EC-Council Certified Incident Handler (E|CIH) + SEI Computer Security Incident Handler (CSIH) + NICCS Certified Incident Handler Engineer (CIHE) + eLearnSecurity Incident Handling & Response Professional (IHRP) + GIAC Certified Forensic Examiner (GCFE)

Benefits

• Health, Dental, and Vision Insurance
• Wellness Programs
• Health Savings Account
• No-cost Personal Health Advocate
• Medical Plan Opt-out Credit
• 401K with Employer Match
• Railroad Retirement Benefits
• Public Service Student Loan Forgiveness
• Student Loan Assistance
• Tuition and Education Reimbursement
• Life Insurance
• Short- and Long-term Disability Insurance
• No-cost Financial Advisor Sessions
• Generous Paid Time Off
• Paid Caregiving Days and Backup Care
• Fertility and Family Building Benefits
• Adoption and Surrogacy Assistance
• Paid Family Leave
• Rail Pass Privileges
• Employee Assistance Program
• Commuter and Flexible Spending Accounts
• Amtrak may offer additional incentive and pay programs to recognize and reward our employees, including a short-term incentive bonus based upon factors such as individual and company performance that is commensurate with the level of the position.
• Amtrak offers several options for a working environment including 100% remote, on-site, and/or a hybrid schedule.

Company Overview

Company H1B Sponsorship