Sr.Security Engineer-Incident Response

Alphalogic, Inc.; Washington (District of Columbia); On-site; USD 110,000 - 150,000; Full time

Job summary

Alphalogic, Inc. is seeking an experienced Information Security professional to conduct incident response by analyzing security events and managing malware threats. The role requires a minimum of 10 years of overall experience, with 7 years in the field of Information Security, including experience with CSIRT and malware analysis.

Candidates must have a strong understanding of operating systems, network traffic, and malware analysis tools. Certifications such as GCIA and CISSP are preferred. Due to the nature of the role, U.S. Citizenship or GC Holders are encouraged to apply.

Qualifications

• 10+ years overall with 7 years in Information Security.
• 2+ years working with CSIRT.
• Experience conducting malware analysis.
• Exposure to APT-type malware and financial-crime malware.
• Understanding of Windows Internals and memory management.

Responsibilities

• Conduct investigative actions on security events.
• Participate in Incident Response phases.
• Review automated daily security reports and identify anomalies.
• Document vulnerabilities and exploits.
• Develop tools for identifying 0-day malware.

Skills

Incident Response

Malware Analysis

Network Traffic Analysis

Operating Systems Understanding

Scripting (Perl, Python, TCL/TK)

Education

GIAC Certified Intrusion Analyst (GCIA)

GIAC Certified Incident Handler (GCIH)

Certified Information Systems Security Professional (CISSP)

Tools

Network Sniffers

Process Analysis Tools

Registry Analysis Tools

File Analysis Tools

Memory Analysis Tools

Job description

Alphalogic is a global technology solutions company headquartered in the Washington, DC metropolitan area. Alphalogic offers a wide range of technology and consulting services; predictive analytics, data warehousing & BI, cloud consulting, web & mobile application development.

Cutting-edge Technologies: Our company’s core competencies are cloud and mobile computing; healthcare solutions and services; data warehousing-analytics- business intelligence; and enterprise collaboration-content management. Alphalogic teams are continually deploying emerging technologies to meet our clients’ current challenges.

Industry Best Practices: Alphalogic specializes in the effective use of industry-standard frameworks such Agile, for helping our clients achieve quick wins and reduce cycle times.

Job Description

Conduct thorough investigative actions based on security events and remediation as dictated by standard operating procedures. Participate in all phases of Incident Response process, including detection, containment, eradication, and post‑incident reporting. Record detailed Incident Response activities in the Incident Case Management System. Review automated daily security reports of key security controls, identify anomalies and, if necessary, escalates critical security events to the appropriate stakeholders and follow up as required. Wherever required perform memory forensics. Document vulnerabilities and exploits used while analyzing malware. Analyze, evaluate, and document malicious code behavior. Identify commonalities and differences between malware samples for purposes of grouping or classifying for attribution purposes. Develop tools to identify a 0‑day malware based on various characteristics of a file format. Assist the COT lead in developing Incident Response Toolkit.

Qualifications

Minimum 10 years overall with 7 years of Information Security experience required, out of which the individual has worked with CSIRT for a minimum of 2 years and at least 2 years conducting some form of malware analysis. Understanding of how operating systems work and how malware exploits them. Understanding of network traffic and be able to analyze network traffic introduced by the malware. Past exposure to APT‑type malware and financial‑crime malware such as Zeus and Spyeye, etc. Experience in researching vulnerabilities and exploits. Experience in writing quick scripts using Perl, Python, or TCL/TK. Thorough understanding of Windows Internals and memory management. Knowledge of common hacking tools and techniques. Experience in understanding and analyzing various log formats from various sources. Experience in analyzing reports generated by SIM/SEM tools. Proficient experience with the following concepts and related toolsets:

• Network sniffers
• Process analysis tools
• Registry analysis tools
• File analysis tools
• Memory analysis tools

Individuals who have worked in night shift and in a security operations center would be preferred.

GIAC Certified Intrusion Analyst (GCIA) or GIAC Certified Incident Handler (GCIH). Certified Information Systems Security Professional (CISSP).

Additional Information

Due to the nature of this contract, candidates with U.S. Citizenship or GC Holders are encouraged to apply. All your information will be kept confidential according to EEO guidelines.