Sr. Information Security Analyst – Threat and Response

JOB SUMMARYThe ideal candidate must be able to hunt and analyze various data sources including, but not limited to: operating system images, firewall logs, endpoint telemetry, linux logs, windows logs, etc. Additional duties include ad-hoc forensic collection of artifacts, threat hunting, supporting CIRT/SOC team and the creation of standard operating procedures documentation.

CANDIDATE PROFILE

Education and Experience

Required:

• Bachelor’s degree in Computer Sciences or related field or equivalent experience/certification
• 5+ years of information technology experience, preferably in a Information Security role.
• 2+ years’ experience implementing, managing or governing security technologies, including encryption, network security, intrusion detection and digital forensics

Preferred:

• Current information security certification, including Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA) or Certified Information Systems Security Professional (CISSP)
• Technical leadership experience in a sourced environment
• Working knowledge of endpoint detection and response tools
• Project management skills
• Technical infrastructure operations, administration, or engineering background

CORE WORK ACTIVITIES

Threat Management & Response

• Provides technical response on all high-risk security incidents
• Builds capabilities and excellence in technical security threat management and incident response
• Monitors the effectiveness of the security incident management and making recommendations for improvement
• Models and follows the incident management process for every Security incident
• Adheres to process and associated procedures; contributes to management and update of these procedures
• Investigates and analyzes many different types of security incidents, such as network-, host-, application-, and malware-based intrusions across a broad range of computing environments and technology stacks
• Utilizes the corporate Endpoint Detection and Response tool and SIEM to identify anomalous activity and potential threats to the enterprise infrastructure.
• Performs analysis of adversary tradecraft, malicious code, and capabilities for hunt pivoting purposes.
• Performs research to identify targeted attacks, campaigns, and malware.
• Contributes to process development that support the analysis of log files (ad hoc and static threat hunts) in the corporate SIEM.
• Conducts analysis of intrusion artifacts to determine potential specific adversary and motives.
• Works to facilitate the mitigation of actual and potential incidents
• Effectively communicate and/or summarize (in both verbal and written form) complex threat events or security incident details to multiple audiences, such as executives, legal, and technical staff
• Researches, builds and maintains technology solutions and tools needed to support security incident response investigations and examine digital evidence (for example, network traffic, log, filesystem, memory, and malware analyzers and forensic toolsets); partner with technology teams to innovate solutions to improve preparedness.
• Participates in the design of and carries out security incident preparedness activities, such as compromise assessments and tabletop exercises, and conducting training and awareness sessions for relevant iT RUN groups, Service providers and vendors
• Working familiarity with Python coding / Powershell scripting, open-source red team tools and C2 frameworks.

Maintaining Goals

• Submits reports in a timely manner, ensuring delivery deadlines are met.
• Promotes the documenting of project progress accurately.
• Provides input and assistance to other teams regarding projects.

Managing Work, Projects, and Policies

• Manages and implements work and projects as assigned.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.
• Analyzes information and evaluates results to choose the best solution and solve problems.
• Provides timely, accurate, and detailed status reports as requested.

Demonstrating and Applying Discipline Knowledge

• Provides technical expertise and support to persons inside and outside of the department.
• Demonstrates knowledge of job-relevant issues, products, systems, and processes.
• Demonstrates knowledge of function-specific procedures.
• Keeps up-to-date technically and applies new knowledge to job.
• Uses computers and computer systems (including hardware and software) to enter data and/ or process information.

Delivering on the Needs of Key Stakeholders

• Understands and meets the needs of key stakeholders.
• Develops specific goals and plans to prioritize, organize, and accomplish work.
• Determines priorities, schedules, plans and necessary resources to ensure completion of any projects on schedule.
• Collaborates with internal partners and stakeholders to support business/initiative strategies
• Communicates concepts in a clear and persuasive manner that is easy to understand.
• Generates and provides accurate and timely results in the form of reports, presentations, etc.
• Demonstrates an understanding of business priorities

Marriott International is an equal opportunity employer. We believe in hiring a diverse workforce and sustaining an inclusive, people-first culture. We are committed to non-discrimination on any protected basis, such as disability and veteran status, or any other basis covered under applicable law.