DFIR Engineer II: Threat Detection & IR Specialist

Northwestern Mutual; Milwaukee (WI); Hybrid; USD 89,000 - 134,000; Full time

Benefits offered by this job

Concierge service

Employee resource groups

Job summary

Northwestern Mutual in Milwaukee is seeking a DFIR Engineer II on the Threat Detection & Response team to respond to, investigate and contain anomalous activity indicating security threats. You will stay current on cyber threats and help refine monitoring, detection and response to abnormal network and host activity.

You will collaborate with Detection Eng and Red Team to improve monitoring and automate responses, while participating in an on-call rotation.

Qualifications

• Experience with security tools including SIEM, EDR, AV, CASB, next-gen firewalls and VPN.
• Experience with system and network artifacts.
• Working knowledge of the MITRE ATT&CK framework.
• Familiarity with cloud environments and containerization (AWS, Azure, O365, Docker, Kubernetes).
• Development or scripting language/framework (PowerShell, Python, .Net) and regular expressions.

Responsibilities

• Triage, pivot and correlate across multiple network and host-based log sources.
• Analyze system artifacts and memory for evidence of compromise.
• Proactively hunt for and identify malicious activity in various log sources using threat intelligence and other indicators of compromise.
• Document detailed findings including timelines of events or incidents.
• Continually improve incident response procedures and documentation.
• Engage with Detection Engineering and Red Team to identify opportunities to better monitor/detect suspicious behavior and automate response capabilities.
• Keep up to date on evolving cyber threats and identify methods to detect them.
• Participate in an on-call rotation with other Incident Response Engineers

Skills

SIEM

EDR

Cloud environments

Docker

Kubernetes

PowerShell

Python

Regex

MITRE ATT&CK

Analytical thinking

Communication

Threat hunting

Tools

Docker

Kubernetes

PowerShell

Python

Job description

Northwestern Mutual in Milwaukee is seeking a DFIR Engineer II on the Threat Detection & Response team to respond to, investigate and contain anomalous activity indicating security threats. You will stay current on cyber threats and help refine monitoring, detection and response to abnormal network and host activity.

You will collaborate with Detection Eng and Red Team to improve monitoring and automate responses, while participating in an on-call rotation.