Truist Cyber DFIR Engineer 

United States, Georgia, Atlanta 

388794995

Regular or Temporary:

English (Required)

1st shift (United States of America)As DFIR professionals, individuals in this role demonstrate proficiency in log, code, cloud, identity, network, endpoint, memory, malware, and root cause analysis. The position will directly perform, facilitate, or consult on the entire cyber incident response.

Essential Duties and Responsibilities

Following is a summary of the essential functions for this job. Other duties may be performed, both major and minor, which are not mentioned below. Specific activities may change from time to time.

1. Management of special tasks, as assigned by management, requiring extended time commitment and technical skills.

2. Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, firewall logs, and intrusion detection system [IDS] logs) to identify possible threats to network security.

3. Perform cyber defense incident triage, to include determining scope, urgency, and potential impact, identifying the specific vulnerability, and making recommendations that enable expeditious remediation.

4. Perform real-time cyber incident handling (e.g., forensic collections, intrusion correlation and tracking, threat analysis, containment, eradication, and direct system remediation) tasks.

5. Coordinate and provide technical support to resolve cyber incidents.

6. Perform or help coordinate forensically sound collection of digital evidence and inspect to discern possible mitigation/remediation on enterprise systems.

7. Attend priority calls in support of IT-related outages.

8. Actively engage in team chats, calls, and face to face settings.

9. Constantly improve runbooks, knowledge base entries, and various staff guides.

10. Recommend improvements to automations, alert fidelity, and security controls.

Required Qualifications:

The requirements listed below are representative of the knowledge, skill and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

1. Bachelor’s degree in Computer Science, Computer Engineering, Cybersecurity, or related field of relevant education, certification, or related training.

2. Five years of experience in Cybersecurity or related work

3. Knowledge of one or more cloud platforms and cloud security

4. Knowledge of general information technology (IT) and cybersecurity

5. Knowledge of computer networking concepts and protocols, and network security methodologies.

6. Knowledge of network traffic analysis and packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).

7. Knowledge of operating systems, including Windows/Unix ports and services.

8. Knowledge of modern identity and access management concepts

9. Knowledge of phishing tactics and techniques

10. Knowledge of advanced cyber threats and vulnerabilities.

11. Knowledge of cyber-attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).

12. Knowledge of incident response and handling methodologies.

13. Knowledge of countermeasures to address a variety of threats

14. Knowledge around leveraging automation, ML, and/or AI

15. Knowledge of organization objectives, leadership priorities, and decision-making risks.

16. Knowledge of organizational hierarchy and cyber decision-making processes.

Preferred Qualifications:

1. Experience working in cloud environments, namely Microsoft Azure and Amazon AWS.

2. Industry certifications in general technology (e.g. Network+, AWS Certified Cloud Practitioner, Microsoft Azure Fundamentals, etc.)

3. Industry certifications in cyber security, such as Security+, CySA+, Certified Ethical Hacker (CEH), GIAC Security Essentials (GSEC), Cisco Certified Network Associate (CCNA), GIAC Certified Intrusion Analyst (GCIA), GIAC Security Operations Certified (GSOC), GIAC Certified Incident Handler (GCIH), GIAC Cloud Security Essentials Certification (GCLD)

4. Experience in Security Operations Center (SOC), Network Operations Center (NOC), IT/Cyber Engineering, or Intelligence Community (IC)