As one of the most established cybersecurity companies in the world, we at NetWitness are hard at work every day helping our customers and partners better protect their organizations from cyberattacks. Our products and incident response services are used within most large enterprises, governments and militaries for incident response and threat hunting.
We are looking for someone who leverages in-depth industry knowledge of the business environment and various technical solutions to assist the customer to gain market share and increase operational efficiencies. You will provide technical and consultative leadership for Consulting technical solutions opportunities on a range of complex engagements, focused on an industry or service offering.
Responsibilities
* To provide technical and consultative services on NetWitness solutions on a range of complex consulting engagement projects.
* These projects may include conducting workshops, analyzing requirements, developing solution design and recommendations, documentation, and delivering training of NetWitness solutions for the customer.
* Works closely with project managers (or acts as project manager), other personnel, and the customer to ensure a smooth project implementation and transition from start to completion.
* Delivers services both independently as well as in a team environment, working closely with NetWitness sales, other personnel, and clients.
* Works on complex projects and manages multiple work streams. Defines and authors deliverables. Delivers projects with approved methodology while adhering to margin, planning, and SOW requirements.
* Leads project quality assurance activities, including technical QA reviews. Understands and adheres to proper escalation and change control procedures. Validates requirements, limited prototyping and functionality design and creates proposals that address current and evolving client requirements.
* May manage or function as technical lead on small to medium projects or workstreams of larger, more complex projects. Understands customer business challenges and provides strategy that addresses long term goals. Independently analyzes large amounts of data, provides logical options, create and delivers correct documentation, sound work products and deliverables to achieve customer satisfaction.
* Prepares, maintains and submits activity/progress reports and time recording/management reports in accordance with published procedures. Keeps stakeholders informed of activities and issues promptly. Completes end-of-project reports. Provides knowledge transfer and training throughout and at the completion of assigned projects.
* Prepares detailed project plans of an engagement within the standards of project management methodologies. Reviews and validates statement of work (SOW). Categorizes requirements into a project
Technical Responsibilities
* Work with customers to better enabletheir ability to hunt for and detectthreats.
* Track threat actors and associated tactics, techniques, and procedures (TTPs).
* Hunt for and identify threat actor groupsand their techniques, tools, and processes.
* Provide input on cybersecurity best practices, especially as pertains to threat intel, threat hunting, and using/incorporating Network (NDR), Endpoint (EDR), and Log (SIEM) analysis.
* Develop detection content and use cases within the NetWitness product for Network full packet capture, EDR, SOAR, and SIEM.
* Develop advanced queriesand alerts to detect adversary actions.
* Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc.
* Assess customer gaps in visibility and provide next-step recommendations.
* Assist customers to increase visibility and detection capability, working in synergy with incident response team members and providing expert advice about how to investigate potential attacks.
* Help with sales project scoping,provide guidance to sales/clients.
* Guide and contribute in technical NetWitness course development.
* Assist in development of knowledge checks and technicalassessments.
* Participate in lab and contentQA.
* Maintain Instructor documentation, illustrations, notes, questions, presentation/topic order, tips & tricks for future instructors under existing documentation.
* Assisting in gatheringand building the lab use-cases.
* Assist with lab deployments/upgrades, particularly for lab images,class environments.
* Deliver or help in creatingat least one webinar every 6 months.
* Participate in publiccustomer training events (based on business need).
Required Experience/Qualifications:
* Ability to understand logging mechanisms for industry standardnetwork, security solutions, servers, and databases.
* Good understanding of networking/Security infrastructure.
* Ability to detail out data flow in a given topology.
* Strong communication skills,i.e., verbal, written,listening, and presentation.
* Analytical thinking and problem-solving skills.
* Proficiency in understanding key difference betweenlogs, events, packets,and incidents.
* In-depth knowledge on collection methodology such as Syslog,SNMP, ODBC, LEA, FTP, SFTP.
* Knowledge on various threats, security trends,security policy in the industry.
* Excellent presentation, workshop facilitation and interpersonal skills.
* Professional Level English speaking and writing.
* Federal security clearance can be an added advantage.