Position: DFIR Expert
Company: ITernal Group
Category: Security
Experience required: 3y
English level: upper

**UST Global is looking for DFIR Expert.**

**Responsibilities:**

- On daily basis -
• Perform Threat Hunting exercises to identify behaviours and advanced threat actor activities within the customers’ network, leveraging existing technologies such as EDR and SIEM platforms.
• Build actionable hypothesis to uncover breach evidence aligned with the MITRE framework and other priorities.
• Research new emerging threats, vulnerabilities and Threat Intelligence insights regarding the changing threat landscape, and develop hunting procedures, leveraging the latest indicators of attack (IOA) and latest threat trends.
• Manage customer’s threat hunting program and help them to make their security posture more mature: engage with the key people from customer side, identify security issues in their environment, schedule and execute hunting activities and create timely reports (measured by content and deadlines).

- During crisis of escalated major incidents –
• Act as an Incident Manager to engage several teams to handle a complete end-to-end incident investigation.
• Respond quickly (24/7) and assist with containment and eradication steps in infected environments to help remediate the threat.
• Analyze the incident and track the attacker’s activity second-by-second on the infected system to get in-depth timeline analysis.
• Create detailed technical DFIR reports on escalated major incidents.

**Requirements:**
•Experience of 3–5 years as a Cyber Threat Hunter or an Incident Responder, in investigating security incidents according to the IR methodology.
• Deep knowledge of comprehensive forensic investigation of network, endpoint, memory, and cloud logs.
• Deep knowledge and understanding of attacks and compromise footprints.
• Knowledge of operating systems essentials, including Linux/Unix and Windows.
• Knowledge in baseline network communications and user behavior.
• Previous experience with SIEM and EDR platforms as part of a SOC group.
• Knowledge of current threats, vulnerabilities, and attack trends.

Nice-to-have skills or certificates:
• Knowledge in SOAR automations and\or Python scripting language.
• Experience with Jupyter notebooks.
• Static or dynamic malware analysis skills, using Disassemblers, Debuggers and Decompilers.
• GIAC Certified Forensic Analyst (GCFA).
• GIAC Certified Forensic Examiner (GCFE).
• Certified Computer Forensics Examiner (CCFE).

**We offer:**
• The environment where you can implement your ideas.
• Plans for growth and performance review.
• Flexible schedule and opportunities to work remotely (8 hours workday).
• Paid 18 days of vacation and up to 10 sick leaves annually.
• Medical insurance after the trial period.
• English courses.
• Participation in educational activities and thematic conferences.
• Attending professional conferences, summits, workshops, and seminars (70% of the cost offset by the company).
• Team parties and corporate events.