Assistant Manager - Platform Engineering

Job Description

Tata Communications Threat Hunting team plays a key role in identification of cyber threats at early stage and helps organizations to perform necessary incident response.

As part of the MSS Engineering Team, this Threat Hunting Expert is responsible for understanding customer's infrastructure and applications, creating a Threat Hunting Plan, perform proactive iterative hunting against relevant/wild threats, identify presence of cyber threats (such as APT activities, Malwares, Zero-day exploits, etc.) and report it promptly to security operations team (SOC) with necessary artifacts recommendations for next level of incident response.

Responsibilities

• Perform threat research, understand changing threat landscape and adversarial behaviors, write Hypothesis (hunting queries)
• Good understanding of MITRE ATTCK Framework and cyber-attack tactics, techniques, procedures, and attack tools.
• Understanding customer's landscape and perform threat modelling, recurring Threat Hunting execution against customer's landscape and identify threats that evade traditional detection/SIEM.
• Keeping to the trend, research and collecting new threats, APT Malware samples from intelligence Sources.
• Pro knowledge skills in system internals (both windows and Linux systems), AD architecture, and fundamental understanding of network traffic communications protocols (TCP/IP, HTTP, DNS, SMTP, RPC, etc)
• Hands-On skills with EDR monitoring, log Analysis and hunting (Eg: CrowdStrike, MD-ATP, TrendMicro, Sentinel-One, Kaspersky, etc)
• Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure.
• Contributing to the strategic direction for Threat Hunting Incident Response capabilities and approaches.

Anticipated Requirements:

• 4+ years of overall experience, 2+ years of experience in Threat Hunting and Security Incident Response functions.
• Hands-on experience in writing threat hunting hypothesis Active threat hunting executions
• Experience with YARA rules/ KQL queries/ EDR Analysis.
• Experience with multi-tiered mission-critical systems.
• Experience in open-source sandbox and honeypots.
• Strong understanding of threat analysis and incident response practices and methodologies.
• Strong understanding of Internet security and networking protocols.
• Strong knowledge of Windows, Linux, and OSX operating systems.
• Strong hands-on with EDR analysis and Threat Hunting (Eg: Crowdstrike, MD-ATP, TrendMicro, Sentinel-One, Kaspersky, or any alternative OEM)
• Strong analytical skills and ability to identify advanced threats.
• Association with the Cyber security industry would be an advantage.
• Good to have knowledge in document-based Macros and script-based malware.
• Experience in understanding the nature of malicious software, such as bots, worms, and trojans.
• Experience in scripting language (such as python) is an added advantage.

Preferred Certification

• CHFI (or) eCTHPv2