Security Researcher

The Defensive Cyber Security Researcher will be responsible for participating in threat actor based investigations, creating new detection methodology and providing expert support to incident response and monitoring functions.

The focus of the Defensive Cyber Security Researcher is to detect, disrupt and eradicate threat actors from enterprise networks. To execute this mission, the Defensive Cyber Security Researcher will use data analysis, threat intelligence, and cutting-edge security technologies.

The Defensive Cyber Security Researcher will identify and analyze patterns and changes in tactics, techniques and procedures used by attackers to attack the company's IT infrastructure and management staff. The analysis will result in indicators of compromise, accurate understanding of the risk to Novartis IT infrastructure and prioritization of remediation efforts.

About the Role

Key Responsibilities:

• Hunt through huge number of signals to identify new emerging threats, dissect them and extract meaningful insights and indicators of compromise.
• Demonstrate adversary tactics to recognize and analyze malicious activity (techniques, tools and processes) based on a combination of behavioural activity and signature based analysis.
• Participate in "hunting missions" using threat intelligence, analysis of anomalous log data and results of brainstorming sessions to detect and eradicate threat actors on the Novartis network.
• Leverage threat intelligence and analysis of anomalous log data to detect threat actors.
• Provide expert analytic investigative support of large scale and complex security incidents.
• Perform analysis of security incidents for further enhancement of alert catalog; perform in-depth static and dynamic malware reverse engineering; preform ad hoc memory and disk forensics.
• Analyze network traffic protocols and cryptographic algorithms leveraged by malware
• Produce detailed technical reports in support of malware / other hunting investigations.
• Continuously improve processes for use across multiple detection sets for more efficient IT Security operations.
• Document best practices with the Cyber Security staff using available collaboration tools and workspaces.
• Review alerts generated by detection infrastructure for effectiveness and recommend improvements.
• In collaboration with the Security Operations Center: Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc.
• In alignment and collaboration with the Forensics team: Provide forensic analysis of network packet captures, DNS, proxy, Netflow, malware, host-based security and application logs, as well as logs from various types of security sensors.

Essential Requirements:

• BA or BSc in Computer Science or a related field experience
• 5+ years of experience in Incident Response / CERT team or 5+ years of experience with malware investigations.
• Critical understanding of the cyber attacker kills chain elements, with particular emphasis on attack objectives.
• High familiarity with Security, specifically Azure;
• High familiarity and experience with ENDTRA ID / Azure AD security and Conditional Access Policies
• Good familiarity with Red Teaming tools and operations, understanding of Wireshark, Cobalt Strike and more
• Advanced programming skills with scripting languages such as Python/Perl/Ruby.
• Advanced understanding of cyber threat vectors and countermeasures.
• Familiarity with the current nation-state (“APT”) threat landscape and the various actors and groups.
• Skilled in performing kernel-mode debugging on rookit malware.
• Coordinate with other team members to achieve the specified objectives, have a high level of ation and organizational skills, produce detailed technical reports in support of malware / other investigations.