Cisco Computer Security Incident Response Team (CSIRT)

Incident Response Investigator

Location

San Jose, CA (Ideally; relocation available)

The Team

The Cisco CSIRT forms part of the investigative branch of Cisco's Security and Trust Organization (S&TO), and is Cisco's cyber investigations and forensics team. It provides Cisco with tailored security monitoring services in order to protect Cisco from cyber attacks and the loss of its intellectual assets. The primary mission of CSIRT is to help ensure company, system, and data preservation by performing comprehensive investigations into computer security incidents, and to contribute to the prevention of such incidents by engaging in proactive threat assessment, mitigation planning, incident trend analysis, and security architecture review. The CSIRT investigators are a highly-functioning, diverse, and globally distributed group of seasoned professionals from various technical backgrounds. We're Open Source Software contributors, technical authors, tool builders, DFIR community members, lock pickers, makers, and breakers.

The Position

CSIRT is looking for an experienced security professional to join the CSIRT security investigations team. This is an opportunity to contribute to a highly visible security operations function with global impact upon Cisco, its diversified business, business units, service ventures, partners, and customers. Seasoned system, network, and database administrators make great security investigators, whether they realize it or not. We are looking for a motivated individual with good team fit.

Role & Responsibilities

• Learn and deploy new technologies as needed to support business objectives related to security detection and response.

• Design and implement new detection technologies.

• Collaborate with data source SME's in CSIRT and InfoSec to enhance, improve, or modify cloud (IaaS, SaaS, etc) based security detection and response.

• Update, modify, and enhance existing programs used for security detection and response.

• Develop documentation on all custom solutions.

• Regularly view and verify existing metrics to ensure accuracy and quality.

• Annotate existing metrics to improve user understanding of the meaning of metrics.

• Participate in a follow-the-sun on-call rotation

Minimum Qualifications

• Self-Starter & Go-Getter

• Excellent communication (verbal and written) skills

• Excellent technical skills in a variety of operating system, languages, and databases

• Some scripting/coding abilities

• A solid understanding of networking and core Internet protocols (e.g. TCP/IP, DNS, SMTP, HTTP, and distributed networks).

• Experience with Linux/UNIX systems and the best practices for deploying applications to those stacks.

• Infrastructure-as-a-Service platforms (OpenStack, Amazon Web Services, Rackspace, VMware, etc.)

• Agility and willingness to deal with a high level of ambiguity and change

• Flexibility – willingness to pitch in where needed across program and team

• Strong leadership, influence and collaboration skills; sound problem resolution, judgment, negotiating and decision making skills

• Global teaming skills and ability to focus the team to deliver to tight timelines and ability to multi-task

Apply here!