Senior Threat Response Analyst (MDR)

Business Summary: VMware is the leader in virtualisation and cloud infrastructure solutions that enable our more than 350,000 enterprise and SMB customers to thrive in the Cloud Era/A pioneer in the use of virtualisation and automation technologies. Our team of 20,000+ people working in 50+ locations worldwide are committed to building a community where great people want to work long term by living our values of passion, innovation, execution, collaboration, active learning and giving back. If you are ready to accelerate, innovate and lead, join us as we challenge constraints and problem solve for tomorrow today. VMware Carbon Black’s Managed Detection service consists of world class security experts who are responsible for monitoring and validating security events in real time. This includes following procedures to triage and investigate security alerts and provide product specific remediation assistance. We are seeking a Threat Analyst III to join our team. The Threat Analyst III will be responsible for researching confirmed security events in depth, maturing processes, creating, and improving automation and other tools, product improvements, and the mentorship and professional growth of junior analysts. The Analyst will also have opportunities to receive mentorship for professional growth from more senior members of the team. The analyst will be involved with evaluating new security technologies, incident response, penetration testing and the freedom to try out new ideas and technologies to improve the SOC. This role resides in the VMware Security Business Unit, VMware Carbon Black, which is the leader in cloud- native endpoint protection dedicated to keeping the world safe from cyber-attacks. The VMware Carbon Black Cloud consolidates endpoint protection and IT operations into an endpoint protection platform (EPP) that prevents advanced threats, provides actionable insight, and enables businesses of all sizes to simplify operations. Join us in our exciting agile journey of discovery and take part in building a great team that builds a great product by actively participating in the team’s growth, habit, and process improvements! What You’ll Do: • Performs endpoint security monitoring, security event triage, and incident response to detect and respond to advanced threats • Identifies potential gaps and offers solutions to include internal team needs, product improvements and client security posture • Coordinates with other team members and management to investigate, document and report incidents • Collaborate with our Threat Analysis Unit to provide in depth reports of confirmed security incidents and produce technical threat advisory broadcasts about new and emerging threats • The analyst will be responsible for providing training and mentorship to junior analysts to assist with their professional development goals. This will include developing relevant training exercises and classes with the assistance of the leadership team • The analyst will be part of a rotating SOC shift and will need to manage their schedule accordingly so as to ensure there is coverage during SOC shifts • Work with security engineering teams to validate detection effectiveness as well as identifying detection improvements • Maintains records of security events investigated and incident response activities, utilizing case management and ticketing systems • Perform regular reviews of alert tickets handled by junior analysts • Act as senior level analyst to Tier 1 analysts, providing guidance as a product subject matter expert to ensure that remediation recommendations are accurate • Monitors and analyses EDR and Security Information and Event Management (SIEM) to identify security issues for remediation. • Provides recommendations, creates, modifies, and updates EDR and Security Information Event Management (SIEM) tool rules • Ensure that we are implementing best practice security policies that address the client's business need while protecting their vital corporate assets • Take on Security Operations responsibilities when not on a SOC shift: this includes but is not limited to documentation, basic malware analysis, exceptions tracking, security tool management, tuning, and configuration, along with metrics and reporting. • Be a primary for or support ongoing projects by assisting in the automation, implementation, testing, and documentation of security related projects Required: Operating System Skills: Expert level skills in Windows, macOS, and/or Linux. Expert Scripting Skills: Experience with any Unix/Linux Shell scripts, Python, Go, PowerShell, C++, C
, Perl. Technology Experience: • IPD/IDS • Firewalls (e.g. PaloAlto Networks, Checkpoint, Cisco ASA, Juniper SSG, PFSense, etc..) • Experience with threat hunting • Log Management and SIEM (e.g., Splunk, IBM QRadar, HP ArcSight, LogRhythm) • Network Analysis Tools (e.g., Netwitness, Wireshark) • System Analysis and Forensic Tools (e.g., FTK, EnCase) • Endpoint Security (e.g., Carbon Black Endpoint Standard, Carbon Black Enterprise Protection, Carbon Black Enterprise Response, Symantec, McAfee, Forefront) • Windows Management (e.g., WSUS, SCCM, SCOM, Active Directory, Group Policy) • Penetration Testing Tools (e.g., Metasploit, Kali) • Regulatory Regimes a plus (e.g., GDPR, ISO27K, SSAE16, HIPPA, PCI, FISMA) • BS/BA degree in Computer Science, Information Systems, related discipline, or equivalent experience • 7+ years of security incident response, remediation, and threat detection • Exceptional verbal communication skills in relation to technical subject matter • Demonstrated experience as an expert in endpoint, workload, Kubernetes, and network security • Ability to talk to VMware Carbon Black customers in a comprehensive and effective manner and/or experience in a client facing role • Experience with vSphere, vCenter, and VDI in an enterprise capacity preferred • Expert in Windows, macOS, and/or Linux endpoint operating systems • Endpoint security, NGAV, EDR, and threat hunting experience • Proven technical track record with securing Windows, macOS, and Linux operating systems • Static and dynamic malware analysis Strong technical writing skills Additional Qualification: Preferred Certifications • CISSP • GCIH • GCFE • GCFA • SSCP • GREM Category : Engineering and Technology Subcategory: Software Engineering Experience: Manager and Professional Full Time/ Part Time: Full Time Posted Date: 2022-06-03 VMware Company Overview: At VMware, we believe that software has the power to unlock new opportunities for people and our planet. We look beyond the barriers of compromise to engineer new ways to make technologies work together seamlessly. Our cloud, mobility, and security software form a flexible, consistent digital foundation for securely delivering the apps, services and experiences that are transforming business innovation around the globe. At the core of what we do are our people who deeply value execution, passion, integrity, customers, and community. Shape what’s possible today at http://careers.vmware.com. Equal Employment Opportunity Statement: VMware is an Equal Opportunity Employer and Prohibits Discrimination and Harassment of Any Kind: VMware is committed to the principle of equal employment opportunity for all employees and to providing employees with a work environment free of discrimination and harassment. All employment decisions at VMware are based on business needs, job requirements and individual qualifications, without regard to race, color, religion or belief, national, social or ethnic origin, sex (including pregnancy), age, physical, mental or sensory disability, HIV Status, sexual orientation, gender identity and/or expression, marital, civil union or domestic partnership status, past or present military service, family medical history or genetic information, family or parental status, or any other status protected by the laws or regulations in the locations where we operate. VMware will not tolerate discrimination or harassment based on any of these characteristics. VMware encourages applicants of all ages. Vmware will provide reasonable accommodation to employees who have protected disabilities consistent with local law.