Defensive Security Analyst

Palantir Palantir · Enterprise · Washington, DC · Information Security

This role focuses on defensive security operations, managing SOC systems, developing threat detection strategies, and performing incident response and digital forensics. It involves building and automating infrastructure to detect, contain, and eradicate security threats, analyzing artifacts, and partnering with the Information Security team. The role requires TS/SCI clearance and experience in a SOC environment, with programming/scripting skills in Python, PowerShell, or Bash.

What you'd actually do

  1. Build, run, and own infrastructure and automation to detect, contain, and eradicate security threats.
  2. Develop alerting and detection strategies to identify malicious or anomalous behavior.
  3. Develop new and novel defensive techniques to identify or counteract changes in adversary techniques and tactics.
  4. Perform enterprise-wide operations to uncover sophisticated and undetected threats.
  5. Provide expertise in a supporting capacity for incident response activities and digital forensics state preservation, including the capture and preservation of system logs, volatile memory captures, and hard drive (physical or virtual) image captures.

Skills

Required

  • TS/SCI Clearance
  • operating in SOC environment
  • PowerShell
  • Python
  • Bash

Nice to have

  • Knowledge of operating and maintaining a SIEM
  • Knowledge of cloud architectures, particularly AWS
  • Experience in penetration testing
  • Ability to quickly learn new technologies
  • Ability to train others on the use of forensic and incident response techniques and tools

What the JD emphasized

  • TS/SCI Clearance