Mid-Level Cortex XSOAR Engineer

Company Description

Spry Squared is a Minority and Woman Owned Small Business headquartered in Denver, Colorado with offices across the United States of America. We are an experienced federal government and commercial service provider with security cleared personnel working on various projects across the USA and the globe.

Spry Squared provides organizations with Best in Class Enterprise Solutions, Managed IT Services, Cybersecurity Solutions, IT Professional Services, Recruiting Services, Project/Program Management and technology products. We are your strategic partner and value-added reseller, solving complex business challenges by leveraging technology solutions that reduce costs, optimize productivity and minimize risk.

Job Description

An immediate opening for a motivated Mid-Level XSOAR Engineer.

Cortex™ XSOAR (formerly known as Demisto) is a comprehensive security orchestration, automation and response (SOAR) platform that unifies case management, automation, real-time collaboration and threat intel management to serve security teams across the incident lifecycle.

Our client is focused on achieving and maintaining technical advantages using the latest advancements, including custom built cybersecurity capabilities.

As a key part of the team, your responsibilities will be:

• Build Playbooks and Automation scripts on Palo Alto Cortex XSOAR and other SOAR tools.
• Creating documentation and implement XSOAR playbooks using Intelligence Driven Defense, and Defense in Depth methodologies.
• Operationalize the XSOAR platform for ongoing support and threat management. 
• Supporting enterprise incident response efforts.
• Employing automation of advanced forensic tools and techniques for attack reconstruction and intelligence gathering.
• Proactively researching emerging cyber threats.
• Applying analytical understanding of attacker methodologies and tactics, system vulnerabilities, and key indicators of attacks and exploits.
• Collaborating using information and knowledge sharing networks and professional relationships to achieve common goals.
• Providing on-call support for incident response efforts outside of core hours, as required.
• Driving advanced countermeasures through to completion.
• Innovating and delivering new types of countermeasures.

Qualifications

• Requires up to 25% ONSITE with remainder working remotely. 
• MUST HAVE an active SECRET Clearance.
• BS Degree and 7+ years relevant experience in cyber security or network defense, or 5+ years’ experience with relevant certifications (CISSP, SANS GIAC, CEH, etc.).
• Requires experience in cyber security engineering automation and orchestration platforms, specifically XSOAR (formerly known as Demisto).
• Experience in other SOAR platforms (Chronicle, Siemplify, Swimlane, Phantom).
• Experience debugging software and determining the root cause.
• Programming experience in Python.
• Experience and familiarity with IDS/IPS, SIEM, Splunk and endpoint solutions.
• Experience supporting and contributing to incident response activities.
• Proficiency in Operating Systems and Network Protocols.
• Proficiency with Microsoft Windows administrative tools, and the Unix/Linux command line.

PREFERRED QUALIFICATIONS

• Understanding of behavioral based threat models, including ATT&CK, Cyber Kill Chain, Diamond Model, etc.
• Experience with Splunk or other SIEM-type platforms.
• Experience in conventional network/host-based intrusion analysis, digital forensics, or malware analysis.
• Experience defending large cloud infrastructures, including AWS, Azure, etc.
• Experience using and integrating with various open-source intelligence (OSINT) sources.
• Ability to create, modify, and implement both Snort and YARA signatures.
• Working knowledge of Computer Network Exploitation (CNE), Computer Network Attack (CNA) and Computer Network Defense (CND) tools and techniques.

Additional Information

All your information will be kept confidential according to EEO guidelines.

Salary:
$135,000 - $175,000 Depending on Experience