Assistant Manager - Platform Engineering

Tata Communications Limited; Chennai; On-site; INR 1,400,000 - 2,400,000; Full time

Job summary

Tata Communications Limited is seeking a Threat Hunting Expert to join the MSS Engineering Team in Chennai. You will understand customer infrastructure, create a Threat Hunting Plan, and perform proactive hunting against relevant threats.

You will report findings to the SOC with artifacts and guidance for next steps in incident response. Ideal candidates have 4+ years total experience with 2+ years in threat hunting and IR, strong knowledge of MITRE ATT&CK, EDR tools, and scripting.

Qualifications

• 4+ years of overall experience, 2+ years in Threat Hunting and Security Incident Response.
• Hands-on experience in writing threat hunting hypotheses and active hunting executions.
• Experience with YARA rules, KQL queries, EDR analysis.
• Experience with multi-tiered mission-critical systems.
• Experience in open-source sandbox and honeypots.
• Strong understanding of threat analysis and incident response practices.
• Strong understanding of Internet security and networking protocols.
• Strong knowledge of Windows, Linux, and OSX operating systems.
• Hands-on with EDR analysis and Threat Hunting tools.
• Strong analytical skills to identify advanced threats.
• Cyber security industry association is an advantage.
• Knowledge of macros and script-based malware is a plus.
• Experience with Python scripting is an added advantage.

Responsibilities

• Perform threat research and write hypotheses; conduct iterative hunting against relevant threats.
• Understand MITRE ATT&CK tactics, techniques, and procedures; map to customer landscape.
• Perform threat modelling and recurring hunting against customer environments; identify evasion.
• Research new threats and APT malware from intelligence sources.
• Demonstrate hands-on capability with EDR monitoring and log analysis.
• Report findings to SOC with artifacts and recommendations for incident response.
• Contribute to strategic direction of Threat Hunting and IR capabilities.

Skills

Threat Hunting

MITRE ATT&CK

Threat Modelling

YARA Rules

KQL Queries

EDR Analysis

Threat Hunting Hypotheses

Windows/Linux/OSX

Python Scripting

Incident Response

Tools

CrowdStrike

MD-ATP

Trend Micro

SentinelOne

Kaspersky

Job description

Job Description

Tata Communications Threat Hunting team plays a key role in identification of cyber threats at early stage and helps organizations to perform necessary incident response.

As part of the MSS Engineering Team, this Threat Hunting Expert is responsible for understanding customer's infrastructure and applications, creating a Threat Hunting Plan, perform proactive iterative hunting against relevant/wild threats, identify presence of cyber threats (such as APT activities, Malwares, Zero-day exploits, etc.) and report it promptly to security operations team (SOC) with necessary artifacts recommendations for next level of incident response.

Responsibilities

• Perform threat research, understand changing threat landscape and adversarial behaviors, write Hypothesis (hunting queries)
• Good understanding of MITRE ATTCK Framework and cyber-attack tactics, techniques, procedures, and attack tools.
• Understanding customer's landscape and perform threat modelling, recurring Threat Hunting execution against customer's landscape and identify threats that evade traditional detection/SIEM.
• Keeping to the trend, research and collecting new threats, APT Malware samples from intelligence Sources.
• Pro knowledge skills in system internals (both windows and Linux systems), AD architecture, and fundamental understanding of network traffic communications protocols (TCP/IP, HTTP, DNS, SMTP, RPC, etc)
• Hands-On skills with EDR monitoring, log Analysis and hunting (Eg: CrowdStrike, MD-ATP, TrendMicro, Sentinel-One, Kaspersky, etc)
• Conduct research for tracking certain code families, campaigns, or actors through technical analysis of data, malicious codes, and infrastructure.
• Contributing to the strategic direction for Threat Hunting Incident Response capabilities and approaches.

Anticipated Requirements:

• 4+ years of overall experience, 2+ years of experience in Threat Hunting and Security Incident Response functions.
• Hands-on experience in writing threat hunting hypothesis Active threat hunting executions
• Experience with YARA rules/ KQL queries/ EDR Analysis.
• Experience with multi-tiered mission-critical systems.
• Experience in open-source sandbox and honeypots.
• Strong understanding of threat analysis and incident response practices and methodologies.
• Strong understanding of Internet security and networking protocols.
• Strong knowledge of Windows, Linux, and OSX operating systems.
• Strong hands-on with EDR analysis and Threat Hunting (Eg: Crowdstrike, MD-ATP, TrendMicro, Sentinel-One, Kaspersky, or any alternative OEM)
• Strong analytical skills and ability to identify advanced threats.
• Association with the Cyber security industry would be an advantage.
• Good to have knowledge in document-based Macros and script-based malware.
• Experience in understanding the nature of malicious software, such as bots, worms, and trojans.
• Experience in scripting language (such as python) is an added advantage.

Preferred Certification

• CHFI (or) eCTHPv2