Dr. Kundankumar Saraf’s Post

Connect IO is Hiring Title: Tier-3 Threat Hunt Operations Analyst (On-Site) Location: Hyderabad or Noida (On-Site) Contract Office timings: 5 PM IST to 2 AM IST   Overview: We’re looking for a Tier-3 Threat Hunt Analyst to join our Security Operations Center (SOC) on-site. This is a senior role for someone with 7+ years of experience in cybersecurity, specializing in proactive threat hunting and incident response. You’ll be working closely with cross functional teams to find and stop cyber threats before they escalate, and you’ll report directly to the Head of SOC. 1. Proactive Threat Hunting: Lead on-site threat hunting operations to identify hidden cyber threats. You’ll work with tools like Splunk, Microsoft Sentinel, and Logstash, digging through data to uncover anomalies. Use your expertise to develop new hunting strategies and stay ahead of emerging threats, ensuring the organization is always a step ahead of attackers. 2. Incident Response & Escalation: Be the go-to person when things get tough. You’ll handle high-priority security incidents and provide advanced forensic analysis to support fast response and recovery. Work with our Digital Forensics and Incident Response (DFIR) team to dive deep into investigations and come up with quick, effective solutions. 3. Enhance Detection Capabilities: Collaborate with the Detection Engineering team to fine-tune our security systems. The insights you gain from hunting will help improve our detection rules and automate processes to make sure nothing slips through the cracks. Help manage our detection backlog, prioritizing the most critical threats and making sure the team stays focused on what matters most. 4. Cross-Functional Collaboration: You’ll work closely with other SOC squads, like Identity Governance and DFIR, to share knowledge and ensure we’re all aligned in our approach to threat detection and response. Your contributions to weekly standups and retrospectives will help the entire team continuously improve. 5. Advanced Automation: Use your scripting skills (think Python, PowerShell) to automate repetitive tasks and streamline threat detection. This will help make the team’s work more efficient and reduce manual efforts. Leverage SOAR tools to automate investigation and response workflows, so we can react even faster to emerging threats. Preferred Qualifications: A Bachelor’s degree in Cybersecurity, Information Technology, or a related field. Certifications such as GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP), or GIAC Cyber Threat Intelligence (GCTI). Interested Candidates can share their resume to [email protected] #CybersecurityJobs #ThreatHunting #SOC #CyberThreatIntelligence #InformationSecurity #SecurityOperations #HyderabadJobs #NoidaJobs #CyberSecCareers #Python #PowerShell

Did you know that cybercriminals use platforms like LinkedIn and other job search portals to post fake jobs? They appear to be legitimate users by hacking and taking over real accounts or simply create fraudulent accounts to target unsuspecting victims. But that's not all! Threat actors can also pose as candidates to target organizations with ransomware. Joe Stewart, our Principal Security Researcher, says, “They [can] flip it around and … pose as a job seeker and then they try to get the hiring manager to then click on their resume and download some malware and infect them that way. So, what can organizations do to protect themselves? ➡️ Make sure your HR department knows how to recognize phishing lures by engaging a Phishing and Security Awareness Training program that trains employees using real-world scenarios. ➡️ Evaluate 3rd-party risk involved with using job portals (e.g., LinkedIn, Indeed, etc.). ➡️ Engage 24/7 threat detection and response to make sure that even if threat actors gain initial access into your organization, you can stop them from spreading laterally and remove them before they can progress to achieving hands-on objectives. #fakejobs #cyberrisk #jobfraud #ransomware Learn more:

LTI Mindtree is hiring for Threat Intelligence Research. Total experience - 3- 5 years. Location - Mumbai Notice period- 0-30 days. Please share resume at: [email protected] Soorya vk Anuradha Rana Yashasree Maity Shikha Jain Puja Singh Prayash Ghose Dinesh Singh Yendluri Subir Karmakar @Bommakanti Seshasai Attaching JD for reference:  Mandatory Skills  1 Minimum 5 years of experience in Threat Intelligence Hunting  2 Experienced in discovering and gathering Threat data from intelligence feeds  3 Prior experience of developing methodologies for threat data mining to uncover the threat actors and threat vectors  4 Experienced in maintaining developing and continuously evaluating cyber threat intelligence threat intelligence data sources  5 Maintain an understanding of the overall threat landscape cyber malware botnets phishing DDoS physical applicable to Carrier  6 Collect analyze investigate store and disseminate indicators of compromise IOCs  7 Regularly develop and produce written cyber brand and threat intelligence reports  8 Provide support to the Security Incident Response Team and SOC in the effective detection analysis and containment of attacks as well as researching potential IOCs and linking to intelligence.  9 Draft edit and disseminate threat intelligence information briefs to stakeholders' executive leadership and others.  10 Monitoring of security procedures and practices recommend optimizations and improvements when gaps are identified  11 Collaborate with Monitoring and Incident Response team Content Engineering team to build proactive detection logic for threat detection  12 Assist the SOC Monitoring IR team in analysis and resolution of Major incidents  13 Leverage Threat Intelligence gathered to execute Threat Hunting campaigns Following types of Threat Hunting campaigns will be executed  o Threat Indicator driven threat hunting  o Hypotheses driven threat hunting  o MITRE ATTCK framework driven hunting campaigns  14 Escalate true positives to Incident status and assist in relevant incident response  15 Perform end-to-end threat hunting developing maturing and maintaining TTP or attack pattern detection techniques  16 Perform the full threat hunting cycle including recommendations for EDR detection rules  17 Collaborate with IR team to recommend and mitigate the effects caused by an incident  18 Perform technical cyber security investigations on security incidents root cause analysis and deep dive analysis of malicious artifacts analyze threat intelligence identify TTP and attack patterns  19 Help mature the Security Incident Response process to ensure it meets the needs of the global business and is adhered to  20Analyze large and unstructured data sets to identify trends and anomalies indicative of malicious activities.

Threat hunting in a SOC Environment? 1. Define Objectives and Scope • Define Goals: Clearly outline what you aim to achieve through threat hunting, such as identifying advanced persistent threats (APTs), insider threats, or specific attack vectors. • Scope: Determine the scope of your hunt, including the systems, networks, or applications to be analyzed, based on risk profiles and critical assets. 2. Collect and Analyze Data • Data Sources: Identify relevant data sources to collect and analyze, such as logs from endpoints, network traffic, security devices (e.g., firewalls, IDS/IPS), and cloud services. • Data Aggregation: Aggregate logs and data into a centralized platform or SIEM for correlation and analysis. 3. Formulate Hypotheses • Generate Hypotheses: Based on threat intelligence, historical incidents, or suspicious patterns, formulate hypotheses about potential threats or anomalous behaviors that warrant investigation. • Example Hypotheses: “An attacker may be using stealthy exfiltration techniques via DNS tunnels” or “Unauthorized access attempts are occurring during off-peak hours.” 4. Conduct Investigations • Use Advanced Search Techniques: Utilize advanced querying and correlation capabilities of your SIEM or analytics tools to search for indicators of compromise (IOCs) or unusual patterns aligned with your hypotheses. • Apply Behavioral Analysis: Look for deviations from normal behavior and baseline activities across different data sources. 5. Analyze and Validate Findings • Investigate Alerts and Anomalies: Validate potential threats by examining raw logs, network captures, or endpoint forensics data to confirm or refute suspicious activities. • Contextualize Findings: Analyze findings in the context of the organization’s environment, business operations, and known threat landscape. 6. Mitigate and Remediate • Implement Mitigations: Take immediate actions to mitigate confirmed threats or suspicious activities: • Block malicious IP addresses or domains. • Quarantine affected systems. • Update firewall rules or IDS signatures. • Long-Term Remediation: Implement longer-term remediation measures to address root causes and prevent future occurrences. 7. Document and Report • Document Findings: Maintain detailed records of investigations, findings, actions taken, and outcomes for future reference and analysis. • Report to Stakeholders: Prepare reports or briefings to inform stakeholders, including management, IT teams, and incident response teams, about threat hunting activities, findings, and recommendations. 8. Continuous Improvement • Iterate and Refine: Continuously refine threat hunting techniques based on lessons learned, emerging threats, and evolving attack tactics. • Collaborate: Foster collaboration between threat hunters, analysts, and other cybersecurity teams to share insights and enhance collective defense capabilities. Looking to hire a SOC analyst? Here’s my contact - [email protected]

"🔍💻 Join our Cyber Defense Team! Are you passionate about unraveling digital mysteries and safeguarding against cyber threats? We're hiring a Incident Response & Digital Forensics Specialist (someone with strong IR & Investigation Skills with basic/mid level knowledge of Forensics) to lead investigations and fortify our defenses. Apply now and be at the forefront of cybersecurity innovation! #CyberSecurity #DigitalForensics #IncidentResponse #JoinOurTeam"

Level 1: Junior Security Analyst - Solving Basic Security Tasks As a Junior Security Analyst at Level 1, your responsibilities typically involve handling basic security tasks. Here’s a breakdown of the foundational skills and day-to-day activities at this stage: Key Responsibilities Monitor Security Alerts: You will work with tools like SIEM (Security Information and Event Management) systems to monitor traffic and security events. Look for suspicious behavior, such as multiple failed login attempts, unusual network traffic, or unauthorized access to sensitive systems. Triage and Investigate Alerts: At this level, your job is to analyze alerts and determine whether they are actual threats (true positives) or harmless activities (false positives). Investigating an alert might involve: Checking IP addresses for suspicious origins. Reviewing logs from firewalls, intrusion detection systems (IDS), and antivirus software. Cross-referencing known vulnerabilities (CVE database). Basic Threat Containment: If an alert is confirmed as a threat, your first action might be to contain it by: Isolating the affected system from the network. Disabling compromised accounts or privileges. Escalating critical issues to senior security staff or engineers. Documenting Incidents: You’ll write up incident reports for every threat you handle, outlining: What the threat was (e.g., phishing, malware). How it was detected. Actions you took to contain it. Any follow-up or lessons learned Hands-On Experience: Participating in capture-the-flag (CTF) challenges or platforms like TryHackMe and Hack The Box can give you practical experience. Soft Skills: Problem-solving abilities, attention to detail, and a desire to continuously learn. #CyberSecurity   #SecurityAnalyst   #IncidentResponse   #ThreatMonitoring   #SIEM   #PhishingPrevention   #VulnerabilityManagement   #EntryLevelCyber   #SOCAnalyst   #InfoSec   #DigitalSecurity   #CompTIA   #CEH   #EthicalHacking

#hiring *Principal Associate, Cyber Security Operations Center (CSOC) - (Fusion) Analyst*, Atlanta, *United States*, fulltime #opentowork #jobs #jobseekers #careers #Atlantajobs #Georgiajobs #ITCommunications *Apply*: https://lnkd.in/dFaUnHDc Center 3 (19075), United States of America, McLean, VirginiaPrincipal Associate, Cyber Security Operations Center (CSOC) - (Fusion) AnalystThe Cyber Security Operation Center Fusion team synthesizes multi-source security alerting, intrusion investigations, cyber intelligence, and business information into actionable analysis. The Fusion team provides this time-sensitive analysis to empower fellow CSOC operators defending the network and to empower leadership to make informed decisions confronting cyber threats. The associate will be a technical team leader proactively identifying threats, and working across the SOC CSOC operations with contextualized tactical intelligence, driving cross-team initiatives to improve detection and security, conducting internal threat landscape analysis, and finding innovative new ways to automate analysis. The associate in this role will also mentor and train associates to execute fusion analysis responsibilities. General Responsibilities:Support day-to-day cybersecurity threat detection and incident response operations through indicator pivoting, campaign analysis, and tactical intelligenceIdentify and enhance processes where automation has the potential to improve efficiencies, provide actionable data, and facilitate collaboration across CSOCLeverage Security Orchestration, Automation, and Response (SOAR) or Security Information and Event Management (SIEM) tools to identify threat patterns, enrich investigations, and build automation-supported workflowsDeconstruct multi-source reporting into actionable intelligence including Tactics, Techniques, and Procedures TTPs data objects, campaign analysis, and threat patterns.Regularly analyze malware reports to track adversary behaviors and support the construction of a TTP repositoryDevelop expertise on the Capital One threat landscape using internal data, threat trends, and operational metrics to clearly communicate the Capital One threat landscape to senior executives, to include the Chief Information Security Officer and Chief Information Officer. Proactively build and maintain relationships with partner teams, including but not limited to Cyber Intelligence, Red Team, Insider Threat, and Hunt teams.Conduct time-sensitive analysis during cyber investigations, including active threat hunting, malware analysis, and campaign enrichmentRoutinely identify gaps in detection and collaborate with teams across the Cyber organization to mitigate risk, including blocking of malicious indicators, tuning vendor signatures, and instrumenting custom detection rulesSupport the tactical intelligence-to-detection pipeline, to include malware

#urgentlyhiring for – #cybersecurity #incidentresponse #engineer Skillset : #SOC - #splunk , #qualys , #siem #1stRound #face2face #mandatory #shift – 24/7 #location – #bangalore #noticeperiod – #immediatejoiners to #30days #Experience – #6years + #relevant #experience – #5years #JobProfileSummary As the CSIR engineer, the typical day can vary greatly depending on the specific position. They may begin their day by looking over dashboards, reports from the previous day or shift, including checking for any new threats and identifying malware that may have infiltrated the system. also prepare for and respond to system breaches or attacks. These processes might differ between Clients, but they generally include responding to hacks or network insecurities and working to prevent new ones. Your key responsibilities will include but are not limited to: Manage day-to-day operations of reviewing SIEM alert and other vulnerability management tools. Ensure that all the various environments within the Client have adequate scans and assessments performed. Participate in security incident response process when required. Support the Security Management Lifecycle including: o Real-time Monitoring o Incident investigation. o Research. o Correlation. o Trending. o Remediation. o Setup and configure SIEM, including data analysis, rule creation. establish thresholds, reference lists, and other duties. o Setup, investigate, and advanced troubleshooting of log transport agents. Work with Client technology owners and platform leads to ensure vulnerabilities and issues are patched and remediated on time. Oversee the implementation and management of operational security reporting activities. Regularly, meet with the internal team to review security reports, status, review any risks, issues, incidents, and outstanding activities. Vulnerability Management, Malware analysis, Threat hunting and assist in forensic analysis. Managing stakeholder expectations and assisting in the reduction of the impact of a cybersecurity event or incident. Contribute to maintaining knowledge base/playbooks by updating procedural documentation. Actively participate in process improvement with other team members and Wider team. Conduct presentations of the security breaches findings to the business and advise on new measures required to prevent reoccurrence of similar breaches. What would make you a good fit for this role? (Mandatory skills) Experience in working in Security Operation Centre. Demonstrated genuine interests and passion for cybersecurity, incident problem solving is a must. Working knowledge of security operations environments and security incident management & response handling. Hands-on experience in managing Splunk, other SIEM logging solution like Microsoft Sentinel, ArcSight, LogRythm. Hands-on knowledge on the creation of use cases within SIEM solution including advanced correlation rules. share your resume at [email protected]

#urgentlyhiring for – #cybersecurity #incidentresponse #engineer Skillset : #SOC - #splunk , #qualys , #siem #1stRound #face2face #mandatory #shift – 24/7 #location – #bangalore #noticeperiod – #immediatejoiners to #30days #Experience – #6years + #relevant #experience – #5years #JobProfileSummary As the CSIR engineer, the typical day can vary greatly depending on the specific position. They may begin their day by looking over dashboards, reports from the previous day or shift, including checking for any new threats and identifying malware that may have infiltrated the system. also prepare for and respond to system breaches or attacks. These processes might differ between Clients, but they generally include responding to hacks or network insecurities and working to prevent new ones. Your key responsibilities will include but are not limited to: Manage day-to-day operations of reviewing SIEM alert and other vulnerability management tools. Ensure that all the various environments within the Client have adequate scans and assessments performed. Participate in security incident response process when required. Support the Security Management Lifecycle including: o Real-time Monitoring o Incident investigation. o Research. o Correlation. o Trending. o Remediation. o Setup and configure SIEM, including data analysis, rule creation. establish thresholds, reference lists, and other duties. o Setup, investigate, and advanced troubleshooting of log transport agents. Work with Client technology owners and platform leads to ensure vulnerabilities and issues are patched and remediated on time. Oversee the implementation and management of operational security reporting activities. Regularly, meet with the internal team to review security reports, status, review any risks, issues, incidents, and outstanding activities. Vulnerability Management, Malware analysis, Threat hunting and assist in forensic analysis. Managing stakeholder expectations and assisting in the reduction of the impact of a cybersecurity event or incident. Contribute to maintaining knowledge base/playbooks by updating procedural documentation. Actively participate in process improvement with other team members and Wider team. Conduct presentations of the security breaches findings to the business and advise on new measures required to prevent reoccurrence of similar breaches. What would make you a good fit for this role? (Mandatory skills) Experience in working in Security Operation Centre. Demonstrated genuine interests and passion for cybersecurity, incident problem solving is a must. Working knowledge of security operations environments and security incident management & response handling. Hands-on experience in managing Splunk, other SIEM logging solution like Microsoft Sentinel, ArcSight, LogRythm. Hands-on knowledge on the creation of use cases within SIEM solution including advanced correlation rules. share your resume at [email protected]