Incident Response Analyst - Skillbridge (remote)

CrowdStrike CrowdStrike · Enterprise · United States · Remote

CrowdStrike is seeking an Incident Response Analyst for their DoD SkillBridge program. This role involves supporting the incident response lifecycle through triage and investigation of security detections, developing detection criteria, identifying data and tooling gaps, providing security reporting, and participating in incident response management. The position requires experience responding to security events, knowledge of operating systems and networking, and experience with log analysis and SIEM workflows. Scripting and Splunk experience are preferred.

What you'd actually do

  1. Support Incident Response lifecycle via triage and investigation of detections and take action as appropriate (e.g. live response, containment, escalation, etc.)
  2. Develop detection criteria across a broad range of technologies and log sources
  3. Identify coverage and efficiency gaps in available data and tooling
  4. Provide information security reporting including security metrics as required
  5. Participate in incident response and manage escalations as needed

Skills

Required

  • Meets DoD SkillBridge Qualifications
  • Current Active Duty Service Member
  • Available to participate 90-180 days
  • US Citizenship required due to direct work related to GovCloud
  • Experience responding to security events, including front-line analysis and escalation, of hacktivist, cybercrime, and APT activity
  • Theoretical and practical knowledge with Mac, Linux, and Windows operating systems
  • Theoretical and practical knowledge with TCP/IP networking and application layers
  • Experience with access/application/system log analysis, IDS/IPS alerting and data flow, and SIEM-based workflows
  • Experience with security data collection, processing, and correlation
  • Capable of completing technical tasks without supervision
  • Desire to grow and expand both technical and soft skills
  • Strong project management skills
  • Contributing thought leader within the incident response industry
  • Ability to foster a positive work environment and attitude
  • Pursuing an undergraduate degree or direct experience in information security, information systems, or computer science
  • Applicable security certifications (GCIA, GCIH, GCFA, GNFA, etc.)

Nice to have

  • Scripting experience highly desirable (Python, Perl, Bash, Power Shell, etc.)
  • Experienced user of Splunk
  • Experience with host and network forensics
  • Experience with basic static and behavioral malware analysis
  • Previous project management experience desirable

What the JD emphasized

  • Experience responding to security events, including front-line analysis and escalation, of hacktivist, cybercrime, and APT activity
  • Theoretical and practical knowledge with Mac, Linux, and Windows operating systems
  • Theoretical and practical knowledge with TCP/IP networking and application layers
  • Experience with access/application/system log analysis, IDS/IPS alerting and data flow, and SIEM-based workflows
  • Experience with security data collection, processing, and correlation