وصف الوظيفة
Role Overview
Lead Consultant – FortiGuard Incident Response at Fortinet, reporting to the Director of Operations for FortiGuard Security Consulting Services. This is a hands-on, customer-facing role within a world-class incident response and forensics team.
Company Overview
Fortinet protects people, devices, and data everywhere through its Security Fabric platform, which delivers broad, integrated, and automated protections across the entire digital attack surface. The company secures critical devices, data, applications, and connections from the data center to the cloud to the home office. Fortinet ranks #1 in security appliances shipped worldwide, with more than 615,000 customers. The Fortinet NSE Training Institute provides one of the largest and broadest training programs in the industry to make cyber training and new career opportunities available to everyone.
Role Purpose
Lead and manage incident response engagements while mentoring junior security consultants. Leverage in-depth understanding of threat actors' tactics, techniques, procedures, and tools alongside FortiEDR tooling to rapidly establish situational awareness, guide team members, and provide client direction. Contribute to threat research and process improvement for customer-facing incident response services.
Key Responsibilities
Engagement Leadership & Client Management
- Lead incident response engagements and mentoring and training of junior analysts.
- Serve as the primary contact for clients during investigations, delivering clear technical and executive-level updates.
Incident Response & Forensics
- Conduct host-based analysis and forensic functions on Windows, Linux, and Mac OS X systems.
- Review firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity.
- Perform memory forensics and file analysis as needed.
- Perform basic reverse engineering of threat actors' malicious tools.
Threat Detection & Analysis
- Leverage the FortiEDR Platform to conduct investigations to rapidly detect and analyze security threats.
- Contribute to threat intelligence consumption and generation within the FortiGuard threat intelligence ecosystem.
- Conduct static and dynamic malware analysis.
Reporting & Communication
- Develop complete and informative reports and presentations for both executive and technical audiences.
Process & Service Improvement
- Continue to focus on process improvement for the customer-facing incident response services.
Availability
- Maintain availability during nights and weekends as needed for incident response engagements.
Qualifications & Experience
- Bachelor's degree in Computer Engineering, Computer Science, or related field, or 10+ years' experience with incident response and/or forensics.
- Hands-on experience dealing with APT campaigns, attack Tactics, Techniques and Procedures (TTPs), memory injection techniques, static and dynamic malware analysis, and malware persistence mechanisms.
- Strong knowledge of operating system internals and endpoint security experience.
Skills & Competencies
Communication
- Excellent written and verbal communication skills.
- Able to communicate with both technical and executive personnel.
- Experience interfacing with customers.
Technical & Forensic Tools
- Experienced with EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open source forensic tools.
- Experience with malware analysis tools such as IDA Pro, OllyDbg, and Immunity Debugger.
- Ability to data mine using YARA, RegEx, or other techniques to identify new threats.
Programming & Scripting
- Experience with at least one scripting language: Shell, Ruby, Perl, Python, or equivalent.
Operating Systems & Analysis
- Analysis of Linux and Mac binary files and understanding of Mac internals is a plus but not required.
- Solid understanding of Active Directory and how to secure it is a plus.
Work Style & Attributes
- Highly motivated, self-driven, and able to work both independently and within a team.
- Able to work under pressure in time-critical situations.
- Able to work occasional nights and weekends.
Additional Information
- Occasional nights and weekends work required for incident response engagements.