Senior Security Analyst

BlackSky Global; Seattle (WA); On-site; USD 120,000 - 160,000; Full time

Benefits offered by this job

Health insurance

401(k) with employer match

Paid time off

On-site gym

Casual offices

Stock Purchase Program

Job summary

BlackSky Global in Seattle, WA is seeking a Senior Security Analyst to join our Security Operations Center. You will monitor, defend, and secure our enterprise environment, analyzing logs from networks, devices, and cloud services in an integrated SIEM.

You will perform DFIR analyses, threat hunting, and develop detections and dashboards to accelerate response. Strong Linux/Windows security background and relevant certifications are expected.

Qualifications

• Experience performing IR, DFIR, malware analysis, and threat hunting.
• CISSP and/or GIAC certifications or equivalent security credentials.
• Extensive experience with Windows, MacOS, and Linux security operations.
• Ability to document processes and results of technical analysis for peers.

Responsibilities

• Monitor, defend, and secure BlackSky’s enterprise environment.
• Analyze logs from networks, devices, cloud services, and applications in a SIEM.
• Develop searches, dashboards, and alerts to improve detection and response.
• Perform DFIR across corporate, product, and mission environments.
• Lead threat hunting and coordinate remediation with IT and product owners.
• Ensure compliance with CIS, STIGs, NIST, and customer-specific requirements.
• Document findings and share with security, IT, and product teams.

Skills

Incident Response

Digital Forensics

Malware Analysis

Network Traffic Analysis

Threat Hunting

Education

GIAC Certified Incident Handler (GCIH)

CISSP

AWS Certified Security - Specialty

GIAC Cloud Penetration Tester (GCPN)

EnCase Certified Examiner (EnCE)

Tools

SIEM

Job description

• The Senior Security Analyst position reports to the Manager of Security Analysis Team (ie, Security Operations Center (SOC)) with rollup to the Director of Security and plays a vital role in monitoring, defending, and securing the BlackSky enterprise environment against cyber threats
• You will perform continuous monitoring of network, managed devices and identities, cloud services, business systems, and application traffic in support of BlackSky’s Security Operations Center (SOC)
• You will conduct analysis of these logs within an integrated Security Information and Event Management (SIEM) platform and work to develop novel searches, dashboards, and alerts to improve the SOC’s detection and response timelines
• You will leverage cyber threat intelligence (CTI) reporting in conjunction with internal digital forensics and incident response (DFIR) activities to ensure BlackSky is properly positioned to defend against security threats to our enterprise networks
• Perform security monitoring and digital forensics and incident response (DFIR) activities across corporate, product, and mission environments by reviewing events and alerting attributed to indicators of compromise (IOCs), indicators of attack (IOAs), cyber threat intelligence (CTI) reporting, and non-compliance activities
• Review multiple sources of cyber threat intelligence and apply the insights appropriately to inform and secure the enterprise
• Conduct regular threat hunting across the corporate, product, and mission environments
• Document procedures for performance of job duties to formalize ad-hoc processes
• Conduct security analysis of data from many sources - system/event logs, network traffic, and SaaS security tools
• Perform analysis, and digital forensics of potential malware using Industry standard Sandbox tools
• Support continuous monitoring of network, operating system, and application log traffic to identify potential security threats related to the industry
• Support vulnerability management process through identification and prioritization of critical security concerns in collaboration with IT or Product owners to drive vulnerability or misconfiguration remediation activities
• Work with product owners to define offensive testing scope requirements and constraints and to support the remediation process on any identified vulnerabilities
• Monitor operational systems for continuous compliance with hardened baseline images against industry checklists such as CIS Benchmarks and/or DISA STIGs,
• Develop solutions to automate reoccurring tasks and improve adversary detection
• Complete compliance assessments and report findings to management
• Document findings (anomalies, incidents, concerns) and share widely with security, IT, and product teams as appropriate to enable enhanced understanding of security posture
• Strong Linux security background with Ubuntu, Amazon Linux, and/or CentOS preferred
• Support security training and manage tabletop scenarios to other employees
• Support SOX/ITGC, CMMC 2.0 Level 2, NIST 800-171 r3, UK Cyber Essentials, and customer-specific compliance requirements
• Other responsibilities as assigned

Benefits

• Competitive compensation: We offer competitive compensation as well as 401(k) with employer match.
• 100% health insurance: We cover 100% of our employee’s health premiums for medical, dental and vision insurance with various plan choices such as HRA, LSA and HSA
• Time off: Striking a balance between work and our personal lives is important. We offer 15 days of PTO, 11 company holidays, four floating holidays (pro-rated based on hire date) and one day of paid volunteerism leave per year.
• Flexible work schedule: Need to focus on family certain hours of the day? Are you a night owl? We can work with you to build a schedule that works best for you and your teammates.
• Maternity leave: New birth mothers receive up to eight weeks of paid leave for medical recovery due to childbirth, supplementing employer-provided disability insurance.
• Parental leave: For births or adoptions, new parents are offered paid leave to care for and bond with their new child.
• ESPP: Be part of the growth and success story at BlackSky by participating in our Employee Stock Purchase Program.
• PC or Mac: You select the type of computing environment that works best for you. And, yes, we are deeply into cloud computing.
• Casual offices: No stuffy environment at BlackSky. We want you for who you are, not what you wear.
• On-site perks: Like to work out at lunch? Visit our on-site gyms. And recharge afterwards with free snacks and beverages.
• Team get-togethers: We host events across teams. Learn who your coworkers are, not just where they sit and what they do.
• Unique swag: Lots of companies offer embroidered hats and gear (and we do, too). But, which of them offer mission patches too?

Qualifications

Experience performing at least one of the following activities - Incident Response, Digital Forensics, Malware Analysis, Network Traffic Collection, or Reverse EngineeringGIAC Certified Incident Handler (GCIH),Access Data Certified Examiner (ACE), and/orGIAC Cloud Penetration Tester (GCPN),Ability to document processes, procedures, and results of technical analysis for review by peersCertified Information Systems Security Professional (CISSP),Must be a U.S. CitizenGIAC Public Cloud Security (GPCS),Experience with implementing, troubleshooting, and sustaining endpoint security mechanisms (e.g., EDR, CASB, and others) in at least one of the following Operating Systems - Windows, MacOS, and/or LinuxGIAC Security Operations Certified (GSOC),GIAC Reverse Engineering Malware (GREM),Encase Certified Examiner (EnCE), AWS Certified Security - SpecialtyComputer Hacking Forensic Investigator (CHFI),GIAC Certified Detection Analyst (GCDA),Candidates should hold at least one of the following security certifications:GIAC Certified Forensic Analyst (GCFA),GIAC Network Forensic Analyst (GNFA),GIAC Cloud Security Automation (GCSA),GIAC Certified Forensic Examiner (GCFE),A minimum of seven (7) years’ experience performing security analyst and DFIR activitiesA minimum of seven (7) years’ experience in IT securityEndpoint Security for Windows, MacOS, and Linux environmentsEnterprise Security Tools: Cisco Duo, Nessus, OpenSCAP, Crowdstrike XDR/MDR, ManageEngine, Cisco Umbrella, Active Directory / Entra ID, NetskopeExtensive incident response, security analysis, and digital forensics experience performing event log, PCAP, and NetFlow data analysis, malware analysis, and data collectionCloud Solutions: Microsoft GCC High, AWS Commercial, AWS GovCloud, VMware ESXiInfrastructure as Code: AWS CloudFormation, HashiCorp TerraformKnowledge of Secure DevOps ProcessesCoding & Scripting: Python, Java, JavaScript, BASH, PowerShellContainer Technologies: Docker, ECS, Nomad, HashiCorp product stack