IR Specialist - Blue Cross Blue Shield Association Chicago, IL, USA Bookmark Share Print 1147 0 3

Listing Description

Job Purpose: 

The position is responsible for performing analysis functions as part of the enterprise cyber defense operations team; investigating cyber threats, conducting analysis of data sources relevant to APT (Advanced Persist Threats); evaluating and making recommendations for the of tools/technologies in support of forensic analysis and cyber defense operations.

Required Job Qualifications:

*Bachelor’s degree and 4 years’ experience in Information Technology OR Technical Certification and 6 years’ experience in Information Technology OR 8 years’ experience in Information Technology
*Experience with detecting and responding to cybersecurity threats in a complex organization.
*Knowledge of operating systems (Windows, *NIX and MacOS), log analysis and forensic tools.
*Experience in malware analysis or malware reverse engineering.
*Knowledge of business portfolios.
*Knowledge of business operations including products and services.
*Oral and written communications.
*Problem solving / analytical skills.
*Understanding of cyber-attack infrastructure, including computer systems and networks.
*Experience in computer investigations or general computer forensics.
*Experience in analysis of TCP/IP network communication protocols, packet capture, log data, and network devices.
*Familiarity with Cyber-attack technology related platforms and tools.
*Experience with chain of custody concepts.
*Awareness of the Cyber Kill Chain, MITRE ATT&CK Framework, and Intelligence Driven Defense.
*Teamwork and collaboration.
*Organized and detail oriented.
*Analytical and problem-solving skills.
*Ability to work under stress in emergencies.
*Customer focus and the ability to manage customer expectations.

Preferred Job Qualifications:

*Bachelor’s OR Master’s Degree in Computer Science, Information Systems, or another related field. Or equivalent work experience and industry related certifications.
*Experience using knowledge of threat actor TTPs, MITRE ATT&CK framework, and the cyber-attack life cycle in the digital investigation’s life cycle.
*Experience with Powershell, Python, or other scripting language and its application to incident handling and digital investigations
*In-depth knowledge in at least one of these areas
      *Network traffic analysis and network security monitoring concept and technologies
      *Malware/suspicious file triage, analysis, and IOC extraction
      *Endpoint and memory analysis knowledge across multiple operating systems
*Experience using a variety of digital data sources to conduct analysis and deliver forensic reports
*Knowledge of cyber security incident investigation concepts and processes
*Experience operating in a complex environment such as a large corporate enterprise
*A willingness to work in a collaborative manner
*An open mind that accepts challenges and competing points of view with diplomacy
*Strong appetite for learning