Position: DFIR Expert
Company: ITernal Group
Experience required: 3y
English level: intermediate

**Please, notice, the location - Poland

Areas of Responsibility

On a daily basis:**

• Perform Threat Hunting exercises to identify behaviors and advanced threat actor activities within the customers’ network, leveraging existing technologies such as EDR and SIEM platforms.
• Build actionable hypotheses to uncover breach evidence aligned with the MITRE framework and other priorities.
• Research new emerging threats, vulnerabilities, and Threat Intelligence insights regarding the changing threat landscape, and develop hunting procedures, leveraging the latest indicators of attack (IOA) and latest threat trends.
• Manage customers’ threat hunting program and help them to make their security posture more mature: engage with the key people from the customer side, identify security issues in their environment, schedule and execute hunting activities and create timely reports (measured by content and deadlines).

**During the crisis of escalated major incidents:
**
• Act as an Incident Manager to engage several teams within CyberProof to handle a complete end-to-end incident investigation.
• Respond quickly (24/7) and assist with containment and eradication steps in infected environments to help remediate the threat.
• Analyze the incident and track the attacker’s activity second-by-second on the infected system to get an in-depth timeline analysis.
• Create detailed technical DFIR reports on escalated major incidents

**Requirements:
**
• Proven experience of 3-5 years as a Cyber Threat Hunter or an Incident Responder, in investigating security incidents according to the IR methodology
• Deep knowledge of the comprehensive forensic investigation of the network, endpoint, memory, and cloud logs
• Deep knowledge and understanding of attacks and compromise footprints
• Knowledge of operating systems essentials, including Linux/Unix and Windows
• Knowledge of baseline network communications and user behavior
• Previous experience with SIEM and EDR platforms as part of a SOC group
• Knowledge of current threats, vulnerabilities, and attack trends
• Innovative thinking and problem-solving skills
• Good time management skills; and written and oral communications skills in English
• Experience in working with customers, especially large or enterprise companies

**Nice-to-have skills or certificates:
**
• Knowledge in SOAR automation and\or Python scripting language
• Experience with Jupyter notebooks
• Static or dynamic malware analysis skills, using Disassemblers, Debuggers, and Decompilers
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• Certified Computer Forensics Examiner (CCFE)

**We offer:
**
• Friendly professional staff and warm atmosphere;
• The environment where you can implement your ideas;
• 18 working days of vacation, 10 sick leaves
• Flexible schedule and opportunities to work remotely;
• Participation in educational activities and thematic conferences;
• Team parties and corporate events.