malware analyst

Fortinet

<div><div>We are looking for a Senior Consultant &ndash; FortiGuard Incident Response to work in a dynamic and exciting new position reporting to the Director of Operations for FortiGuard Security Consulting Services. The analyst will work directly with members of a world class incident response and forensics team. Our team is comprised of individuals with strong knowledge in malware hunting and analysis, reverse engineering, multiple scripting languages, forensics and threat actors TTPs . In this very hands-on customer facing role the consultant&rsquo;s main objective is to lead and manage the incident response engagements and train/mentor other security consultants. Leveraging your in-depth understanding of the threat actors&rsquo; tactics, techniques, procedures and tools as well as our flagship FortiEDR tooling you will need to quickly glean situational awareness to provide guidance to the team members as well as to the client. In addition, from time to time the candidate will help to create threat research work products such as blogs and presentations. To be successful in this role the candidate must be possess strong consulting skills, deep technical skills and able to work under tight timelines. 
</div>Responsibilities:
<ul><li>Assist the IR Lead during engagements and mentoring/training junior analysis
</li><li>Continue to focus on process improvement for the customer facing incident response services
</li><li>Conduct host-based analysis and forensic functions on Windows, Linux, and Mac OS X systems
</li><li>Conduct network forensics and log analysis during IR engagements
</li><li>Review firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity
</li><li>Leverage our FortiEDR Platform to conduct investigations to rapidly detect and analyze security threats
</li><li>Perform memory forensics and file analysis as needed
</li><li>Monitor underground forums, our FortiGuard Threat Labs, along with other open-source intelligence outlets to maintain proficiency in latest actor tactics and techniques
</li><li>Preform basic reverse engineering of threat actor&rsquo;s malicious tools
</li><li>Develop complete and informative reports and presentations for both executive and technical audience
</li><li>Availability during nights/weekends as needed for IR engagements 
</li></ul>Required Skills:
<ul><li>Excellent written and verbal communication skills a must
</li><li>Experience interfacing with customers
</li><li>Experience with of at least one scripting language: Shell, Ruby, Perl, Python, etc
</li><li>Ability to data mine using YARA, RegEx or other techniques to identify new threats
</li><li>Experienced with EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open source forensic tools a plus
</li><li>Experience with malware analysis tools such as IDA Pro, OllyDbg, Immunity Debugger
</li><li>Hands-on experience dealing with APT campaigns, attack Tactics, Techniques and Procedures (TTPs), memory injection techniques, static and dynamic malware analysis and malware persistence mechanism
</li><li>Strong knowledge of operating system internals and endpoint security experience.
</li><li>Able to communicate with both technical and executive personnel
</li><li>Static and dynamic malware and log analysis
</li><li>Analysis of Linux and MAC binary files and the understanding of MAC internals is a plus but not required .
</li><li>Highly motivated, self-driven and able to work both independently and within a team
</li><li>Able to work under pressure in time critical situations and occasional nights and weekends work
</li><li>A solid understanding of Active Directory and how to secure is a plus
</li></ul>Education:
<ul><li>Bachelor&rsquo;s Degree in Computer Engineering, Computer Science or related field
</li><li>Or 5+ years&rsquo; experience with incident response and or Forensics</li></ul></div>

Senior Consultant - FortiGuard Incident Response

CrowdStrike

<div>As a global leader in cybersecurity, CrowdStrike protects the people, processes and technologies that drive modern organizations. Since 2011, our mission hasn&rsquo;t changed &mdash; we&rsquo;re here to stop breaches, and we&rsquo;ve redefined modern security with the world&rsquo;s most advanced AI-native platform. Our customers span all industries, and they count on CrowdStrike to keep their businesses running, their communities safe and their lives moving forward. We&rsquo;re also a mission-driven company. We cultivate a culture that gives every CrowdStriker both the flexibility and autonomy to own their careers. We&rsquo;re always looking to add talented CrowdStrikers to the team who have limitless passion, a relentless focus on innovation and a fanatical commitment to our customers, our community and each other. Ready to join a mission that matters? The future of cybersecurity starts with you.
About the Role:
At CrowdStrike we&rsquo;re on a mission - to stop breaches. Our groundbreaking technology, services delivery, and intelligence gathering together with our innovations in machine learning and behavioral-based detection, allow our customers to not only defend themselves, but do so in a future-proof manner. We&rsquo;ve earned numerous honors and top rankings for our technology, organization and people &ndash; clearly confirming our industry leadership and our special culture driving it.
The opportunity: Our CrowdStrike Data Science Machine Learning Operations and Response Team is looking for a Threat Analyst who is both customer- and team-focused. This role will include both response and pro-active aspects. This role will be perfect for anyone who has experience involving detections and/or reverse engineering. The primary responsibility of this role will be to analyze malware and detections by investigating individual customer detection tickets. This team is focused on improving detection capability and efficiency through analysis of malware or other threat detections impacting our customer base. Experience with detections of potentially malicious behavior by machine learning models is a plus.
Bring your passion for helping internal partners resolve questions about detections of potentially malicious activity by machine learning and our detection capability. Our goal for the team is to both help internal teams respond to customer-inquiries about threat detection and to provide information about the effects of our detections into the Data Science organization - including detection efficacy and managing false positive detections.
This role will work most closely with internal teams such as Technical Account Managers, Falcon Complete, Data Scientists and the Malware Research Center in Data Science.
What You'll Do:<ul><li>
Analyze detection data including customer reports to determine which aspects of the machine learning models can be improved</li><li>
Perform tasks to enable better-management of false positive detections</li><li>
Analyze binary files to determine their legitimacy</li><li>
Review current product detections to ensure they are performing to the company standard</li><li>
Address internal questions and concerns regarding customer threat detections</li></ul> 
What You'll Need:
Required:<ul><li>
Exposure and understanding of different types and functionality of malware</li><li>
Experience with reverse engineering malware, or malware operations</li><li>
Knowledge of programming and scripting languages, in particular Python</li><li>
Fundamental understanding of attributes of binary files such as imports/exports and packers</li><li>
Ability to demonstrate practical knowledge of research/collection skills and analytical methods</li><li>
General understanding of threat/risk management and threat/risk assessment</li><li>
Familiarity with various operating systems</li><li>
Ability to break down complex problems into workable components</li></ul> 
Preferred:<ul><li>
Experience in a security operations center or similar environment responding to incidents</li><li>
A thorough understanding of Windows OS internals and the Windows API</li><li>
Knowledge of MacOS and/or Linux</li><li>
Familiarity with tools used in targeted and criminal cyber-intrusions</li><li>
A background in exploit and vulnerability analysis</li><li>
Knowledge of a variety of programming languages including C, C++, Java, and assembly</li><li>
Experience with threat detections by machine learning</li></ul><div><div><div><div><div><div><div><div><div>
#LI-Remote 
#LI-AO1</div></div></div></div></div></div></div></div></div>
Benefits of Working at CrowdStrike:<ul><li>
Market leader in compensation and equity awards</li><li>
Comprehensive physical and mental wellness programs</li><li>
Competitive vacation and holidays for recharge</li><li>
Paid parental and adoption leaves</li><li>
Professional development opportunities for all employees regardless of level or role</li><li>
Employee Networks, geographic neighborhood groups, and volunteer opportunities to build connections</li><li>
Vibrant office culture with world class amenities</li><li>
Great Place to Work Certified&trade; across the globe</li></ul>
CrowdStrike is proud to be an equal opportunity employer. We are committed to fostering a culture of belonging where everyone is valued for who they are and empowered to succeed. We support veterans and individuals with disabilities through our affirmative action program.
CrowdStrike is committed to providing equal employment opportunity for all employees and applicants for employment. The Company does not discriminate in employment opportunities or practices on the basis of race, color, creed, ethnicity, religion, sex (including pregnancy or pregnancy-related medical conditions), sexual orientation, gender identity, marital or family status, veteran status, age, national origin, ancestry, physical disability (including HIV and AIDS), mental disability, medical condition, genetic information, membership or activity in a local human rights commission, status with regard to public assistance, or any other characteristic protected by law. We base all employment decisions-including recruitment, selection, training, compensation, benefits, discipline, promotions, transfers, lay-offs, return from lay-off, terminations and social/recreational programs-on valid job requirements.
If you need assistance accessing or reviewing the information on this website or need help submitting an application for employment or requesting an accommodation, please contact us at recruiting@crowdstrike.com for further assistance.
Find out more about your rights as an applicant.
CrowdStrike participates in the E-Verify program.
Notice of E-Verify Participation
Right to Work
CrowdStrike, Inc. is committed to fair and equitable compensation practices. Placement within the pay range is dependent on a variety of factors including, but not limited to, relevant work experience, skills, certifications, job level, supervisory status, and location. The base salary range for this position for all U.S. candidates is $90,000 - $125,000 per year, with eligibility for bonuses, equity grants and a comprehensive benefits package that includes health insurance, 401k and paid time off.
For detailed information about the U.S. benefits package, please click here.</div>

Machine Learning Detection Engineer (Remote, East/Central)

Digital Envoy

<div>
 
 Description
 
 
 
 Digital Envoy (DE) is the leader in geolocation and VPN data for over 25 years for customers in various verticals &mdash; Streaming Media, Ad Tech, Cybersecurity, E-commerce, and Data Analytics. Our core product, IP address geolocation, powers customers like Netflix, Hulu, Trade Desk, PayPal, AWS, Apple, and many others. Our VPN and Proxy data, coupled with accurate IP address geolocation, helps companies determine malicious activity for threat intelligence, authentication, and digital privacy.
 
 
 We are looking for a Cybersecurity Research Engineer to further our efforts on our VPN Proxy product. The Engineer will work to understand and investigate mobile software by identifying threats and performing analysis on software that potentially compromises devices.
 
 
 This person can work remotely from any of the following states: California (CA), Colorado (CO), Connecticut (CT), Florida (FL), Georgia (GA), Kentucky (KY), Massachusetts (MA), Michigan (MI), New York (NY), New Jersey (NJ), North Carolina (NC), Pennsylvania (PA), South Carolina (SC), Tennessee (TN), Texas (TX), Virginia (VA), Washington (WA).
 
 
 Georgia residents are encouraged and welcomed to join us a couple days/week in our Peachtree Corners, Georgia office.
 
 
 Please note, at this time, Digital Envoy is not sponsoring visas for this position.
 
 
 
 What You'll Do
 
 
 
 <ul>
 <li>
 Write scalable code and perform intelligence analysis in order to identify threats
 </li>
 <li>
 Identify trends with current/emerging threats as they relate to the use of information technology and policies. Research credible new intelligence and subject matter resources to combat them
 </li>
 <li>
 Utilize and enhance existing REST APIs and implement new REST APIs using best practices for a scalable user interface
 </li>
 <li>
 Set the standards for development/coding
 </li>
 <li>
 Provide subject matter expertise to support various operations
 </li>
 <li>
 Leverage AI-assisted research, development, and automation tools to accelerate malware analysis, threat detection, reverse engineering, secure coding practices, and operational efficiency across cybersecurity initiatives.
 
 
 </li>
 </ul>
 
 What We Offer
 
 
 
 <ul>
 <li>
 Competitive Salary &amp; Bonus program
 </li>
 <li>
 Medical, Dental and Vision
 </li>
 <li>
 Paid Holidays &amp; Unlimited PTO policy
 </li>
 <li>
 401(k) with employer contribution match
 </li>
 <li>
 We value your input: make a real impact in a growing company!
 </li>
 <li>
 5 years development experience in Python 3, Perl, C (any other languages welcome)
 </li>
 <li>
 2+ years of relevant work experience in code-level security auditing and secure coding practice
 </li>
 <li>
 Advanced proficiency of Linux, security engineering, computer and network security, IP protocols
 </li>
 <li>
 Strong proficiency with static and dynamic analysis of malicious binaries
 </li>
 <li>
 Some proficiency with Smali
 </li>
 <li>
 Experience with security related data analysis
 </li>
 <li>
 Experience with noSQL databases
 </li>
 <li>
 Familiarity with tools such as IDA Pro or OllyDbg, any debugging/decompiler tools
 </li>
 <li>
 Familiarity with AWS and SQL is a plus
 
 
 </li>
 </ul>
 
 About Digital Envoy
 
 
 
 
 In 1999, Digital Envoy introduced the concept of privacy-sensitive IP-based geolocation and IP intelligence. This technology allows businesses from ad networks to publishers, websites, retailers and more to harness the power of location and new intelligence about connected users for many mission-critical applications. Digital Envoy has three business units that address the unique needs of customers: Digital Element, which provides global geolocation data and services that bring anytime, anywhere relevance and context to online and mobile initiatives; Digital Resolve, which delivers cybersecurity solutions that proactively secure online accounts, information, transactions and interactions from login to logout and Outlogic, which allows companies in retail, real estate, and financial markets to develop disruptive tools built on a foundation of quality location data.
 
 
 
 
 At Digital Envoy, we are excited about building a diverse team and creating an inclusive environment where everyone can thrive. All employees must be authorized to work in the United States. Digital Envoy provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Digital Envoy complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities.
 
 
 
 
 Requirements
 
 
 
 
 WHO YOU ARE:
 
 
 
 <ul>
 <li>
 5 years development experience in Python 3, Perl, C (any other languages welcome)
 </li>
 <li>
 2+ years of relevant work experience in code-level security auditing and secure coding practice
 </li>
 <li>
 Advanced proficiency of Linux, security engineering, computer and network security, IP protocols
 </li>
 <li>
 Strong proficiency with static and dynamic analysis of malicious binaries
 </li>
 <li>
 Some proficiency with Smali
 </li>
 <li>
 Experience with security related data analysis
 </li>
 <li>
 Experience with noSQL databases
 </li>
 <li>
 Familiarity with tools such as IDA Pro or OllyDbg, any debugging/decompiler tools
 </li>
 <li>
 Familiarity with AWS and SQL is a plus
 </li>
 <li>
 Familiarity with applying AI/ML-assisted tools and automation techniques to cybersecurity research, malware analysis, secure coding, and threat intelligence workflows
 </li>
 </ul>
</div>

Cybersecurity Research Engineer

<div>Description:

Digital Envoy (DE) is the leader in geolocation and VPN data for over 25 years for customers in various verticals &mdash; Streaming Media, Ad Tech, Cybersecurity, E-commerce, and Data Analytics. Our core product, IP address geolocation, powers customers like Netflix, Hulu, Trade Desk, PayPal, AWS, Apple, and many others. Our VPN and Proxy data, coupled with accurate IP address geolocation, helps companies determine malicious activity for threat intelligence, authentication, and digital privacy.
We are looking for a Cybersecurity Research Engineer to further our efforts on our VPN Proxy product. The Engineer will work to understand and investigate mobile software by identifying threats and performing analysis on software that potentially compromises devices.
This person can work remotely from any of the following states: California (CA), Colorado (CO), Connecticut (CT), Florida (FL), Georgia (GA), Kentucky (KY), Massachusetts (MA), Michigan (MI), New York (NY), New Jersey (NJ), North Carolina (NC), Pennsylvania (PA), South Carolina (SC), Tennessee (TN), Texas (TX), Virginia (VA), Washington (WA).
Georgia residents are encouraged and welcomed to join us a couple days/week in our Peachtree Corners, Georgia office.
Please note, at this time, Digital Envoy is not sponsoring visas for this position.
WHAT YOU'LL DO:<ul><li>
Write scalable code and perform intelligence analysis in order to identify threats</li><li>
Identify trends with current/emerging threats as they relate to the use of information technology and policies. Research credible new intelligence and subject matter resources to combat them</li><li>
Utilize and enhance existing REST APIs and implement new REST APIs using best practices for a scalable user interface</li><li>
Set the standards for development/coding</li><li>
Provide subject matter expertise to support various operations</li><li>
Leverage AI-assisted research, development, and automation tools to accelerate malware analysis, threat detection, reverse engineering, secure coding practices, and operational efficiency across cybersecurity initiatives.</li></ul>
WHAT WE OFFER:<ul><li>
Competitive Salary &amp; Bonus program</li><li>
Medical, Dental and Vision</li><li>
Paid Holidays &amp; Unlimited PTO policy</li><li>
401(k) with employer contribution match</li><li>
We value your input: make a real impact in a growing company!</li><li>
5 years development experience in Python 3, Perl, C (any other languages welcome)</li><li>
2+ years of relevant work experience in code-level security auditing and secure coding practice</li><li>
Advanced proficiency of Linux, security engineering, computer and network security, IP protocols</li><li>
Strong proficiency with static and dynamic analysis of malicious binaries</li><li>
Some proficiency with Smali</li><li>
Experience with security related data analysis</li><li>
Experience with noSQL databases</li><li>
Familiarity with tools such as IDA Pro or OllyDbg, any debugging/decompiler tools</li><li>
Familiarity with AWS and SQL is a plus</li></ul>
About Digital Envoy:
In 1999, Digital Envoy introduced the concept of privacy-sensitive IP-based geolocation and IP intelligence. This technology allows businesses from ad networks to publishers, websites, retailers and more to harness the power of location and new intelligence about connected users for many mission-critical applications. Digital Envoy has three business units that address the unique needs of customers: Digital Element, which provides global geolocation data and services that bring anytime, anywhere relevance and context to online and mobile initiatives; Digital Resolve, which delivers cybersecurity solutions that proactively secure online accounts, information, transactions and interactions from login to logout and Outlogic, which allows companies in retail, real estate, and financial markets to develop disruptive tools built on a foundation of quality location data.
At Digital Envoy, we are excited about building a diverse team and creating an inclusive environment where everyone can thrive. All employees must be authorized to work in the United States. Digital Envoy provides equal employment opportunities to all employees and applicants for employment without regard to race, color, religion, sex, national origin, age, disability or genetics. In addition to federal law requirements, Digital Envoy complies with applicable state and local laws governing nondiscrimination in employment in every location in which the company has facilities.
Requirements:

WHO YOU ARE:<ul><li>
5 years development experience in Python 3, Perl, C (any other languages welcome)</li><li>
2+ years of relevant work experience in code-level security auditing and secure coding practice</li><li>
Advanced proficiency of Linux, security engineering, computer and network security, IP protocols</li><li>
Strong proficiency with static and dynamic analysis of malicious binaries</li><li>
Some proficiency with Smali</li><li>
Experience with security related data analysis</li><li>
Experience with noSQL databases</li><li>
Familiarity with tools such as IDA Pro or OllyDbg, any debugging/decompiler tools</li><li>
Familiarity with AWS and SQL is a plus</li><li>
Familiarity with applying AI/ML-assisted tools and automation techniques to cybersecurity research, malware analysis, secure coding, and threat intelligence workflows</li></ul></div>

Arwen Tech

<div>
 Posted on Apr 16, 2026
 
 
 Title
 
 
 SOC L2 Analyst
 
 
 Apply before
 
 
 May 30, 2026
 
 
 City
 
 
 Karachi
 
 
 
 Responsibilities
 
 
 
 Summary of Job Profile:
 
 
 The SOC L2 Analyst plays a critical role in the proactive defense of the organization's security posture. This individual will leverage their technical expertise and analytical skills to investigate complex security incidents, identify attack patterns, and implement effective countermeasures. The SOC L2 Analyst serves as an escalation point for Tier 1 analysts and contributes to the continuous improvement of SOC processes and security tools.
 
 
 
 Essential Duties &amp; Responsibilities
 
 
 
 <ul>
 <li>
 Monitor security events and alerts generated by various security tools (e.g., SIEM, IDS/IPS, EDR) and escalate complex or high-severity incidents as necessary.
 </li>
 <li>
 Conduct in-depth analysis of security incidents to determine root cause, scope, and impact.
 </li>
 <li>
 Perform threat hunting activities to proactively identify potential security threats that may evade automated detection.
 </li>
 <li>
 Implement containment and remediation strategies for security incidents, including isolating affected systems, blocking malicious traffic, and removing malware.
 </li>
 <li>
 Analyze malware samples and understand their behavior.
 </li>
 <li>
 Develop and refine security incident response procedures and playbooks.
 </li>
 <li>
 Collaborate with Tier 1 analysts, providing guidance and support in incident analysis and handling.
 </li>
 <li>
 Escalate incidents to Tier 3 analysts or other relevant teams (e.g., IR, Engineering) when necessary.
 </li>
 <li>
 Document all incident analysis, containment, and remediation activities in detail.
 </li>
 <li>
 Contribute to the tuning and optimization of security tools and alerting rules.
 </li>
 <li>
 Stay up-to-date on the latest cyber threats, attack techniques, and security vulnerabilities, potentially considering threat trends.
 </li>
 <li>
 Participate in post-incident reviews to identify lessons learned and improve incident response processes.
 </li>
 <li>
 Assist in the development and delivery of security awareness training materials.
 
 
 </li>
 </ul>
 
 Requirements
 
 
 
 Knowledge, Skills, Abilities (KSA&rsquo;s) required to successfully perform the job:
 
 
 
 Knowledge
 
 
 
 <ul>
 <li>
 Strong understanding of TCP/IP and other networking protocols.
 </li>
 <li>
 In-depth knowledge of common cyber threats, attack vectors, and malware types.
 </li>
 <li>
 Familiarity with various security tools and technologies (e.g., SIEM, IDS/IPS, EDR, firewalls, web proxies).
 </li>
 <li>
 Understanding of operating system security (Windows, Linux).
 </li>
 <li>
 Knowledge of security event analysis and correlation techniques.
 </li>
 <li>
 Knowledge of incident response processes and methodologies.
 </li>
 <li>
 Awareness of relevant security regulations and compliance standards.
 </li>
 <li>
 Understanding of threat intelligence sources and their application.
 
 
 </li>
 </ul>
 
 Skills
 
 
 
 <ul>
 <li>
 Proficient in analyzing security logs and identifying malicious activity.
 </li>
 <li>
 Strong understanding of network traffic analysis.
 </li>
 <li>
 Ability to perform basic malware analysis.
 </li>
 <li>
 Skill in using various security tools for incident investigation and response.
 </li>
 <li>
 Good understanding of scripting languages (e.g., Python, PowerShell) for automation.
 </li>
 <li>
 Ability to work effectively under pressure during security incidents
 
 
 </li>
 </ul>
 
 Abilities
 
 
 
 <ul>
 <li>
 Ability to analyze complex security events and identify root causes.
 </li>
 <li>
 Ability to implement effective containment and remediation strategies.
 </li>
 <li>
 Ability to correlate data from various security tools to gain a comprehensive understanding of incidents.
 </li>
 <li>
 Ability to document security incidents clearly and concisely.
 </li>
 <li>
 Ability to learn and adapt to new security threats and technologies.
 </li>
 <li>
 Ability to work independently and as part of a team.
 </li>
 <li>
 Ability to follow established procedures and guidelines
 
 
 </li>
 </ul>
 
 Education, Experience, Licensure, Certification Required For The Position
 
 
 
 <ul>
 <li>
 Bachelor's degree in Computer Science, Information Security, or a related field.
 </li>
 <li>
 3-5 years of experience in a Security Operations Center (SOC) environment, with demonstrable experience in incident analysis and response
 </li>
 <li>
 Relevant security certifications such as CompTIA CySA+, Security+, CEH, or vendor-specific certifications (e.g., Splunk Core Certified User/Power User) are desirable.
 
 
 </li>
 </ul>
 
 Competencies Required To Successfully Perform The Job
 
 
 
 Technical Competencies
 
 
 Behavioral/General Competencies
 
 
 <ul>
 <li>
 SIEM Analysis &amp; Management
 </li>
 <li>
 Basic Malware Analysis
 </li>
 <li>
 Scripting for Automation (e.g., Python, PowerShell)
 </li>
 <li>
 Network Traffic Analysis
 </li>
 <li>
 Endpoint Detection &amp; Response (EDR) Analysis
 </li>
 <li>
 Analytical Thinking
 </li>
 <li>
 Problem Solving
 </li>
 <li>
 Communication (verbal and written)
 </li>
 <li>
 Attention to Detail
 </li>
 <li>
 Responsible
 
 
 </li>
 </ul>
 
 Benefits
 
 
 
 <ul>
 <li>
 Excellent Salary
 </li>
 <li>
 Fuel Allowance
 </li>
 <li>
 Internet Allowance
 </li>
 <li>
 Medical Insurance
 </li>
 <li>
 Annual Leaves
 </li>
 <li>
 Provident Fund
 </li>
 <li>
 EOBI
 </li>
 <li>
 Annual Bonus
 </li>
 </ul>
</div>

SOC L2 Analyst

Hubkom

Summary of Job Profile:The SOC L2 Analyst plays a critical role in the proactive defense of the organization's security posture. This individual will leverage their technical expertise and analytical skills to investigate complex security incidents, identify attack patterns, and implement effective countermeasures. The SOC L2 Analyst serves as an escalation point for Tier 1 analysts and contributes to the continuous improvement of SOC processes and security tools.Essential Duties &amp; Responsibilities<ul><li>Monitor security events and alerts generated by various security tools (e.g., SIEM, IDS/IPS, EDR) and escalate complex or high-severity incidents as necessary.</li><li>Conduct in-depth analysis of security incidents to determine root cause, scope, and impact.</li><li>Perform threat hunting activities to proactively identify potential security threats that may evade automated detection.</li><li>Implement containment and remediation strategies for security incidents, including isolating affected systems, blocking malicious traffic, and removing malware.</li><li>Analyze malware samples and understand their behavior.</li><li>Develop and refine security incident response procedures and playbooks.</li><li>Collaborate with Tier 1 analysts, providing guidance and support in incident analysis and handling.</li><li>Escalate incidents to Tier 3 analysts or other relevant teams (e.g., IR, Engineering) when necessary.</li><li>Document all incident analysis, containment, and remediation activities in detail.</li><li>Contribute to the tuning and optimization of security tools and alerting rules.</li><li>Stay up-to-date on the latest cyber threats, attack techniques, and security vulnerabilities, potentially considering threat trends.</li><li>Participate in post-incident reviews to identify lessons learned and improve incident response processes.</li><li>Assist in the development and delivery of security awareness training materials.</li></ul>RequirementsKnowledge, Skills, Abilities (KSA&rsquo;s) required to successfully perform the job:Knowledge<ul><li>Strong understanding of TCP/IP and other networking protocols.</li><li>In-depth knowledge of common cyber threats, attack vectors, and malware types.</li><li>Familiarity with various security tools and technologies (e.g., SIEM, IDS/IPS, EDR, firewalls, web proxies).</li><li>Understanding of operating system security (Windows, Linux).</li><li>Knowledge of security event analysis and correlation techniques.</li><li>Knowledge of incident response processes and methodologies.</li><li>Awareness of relevant security regulations and compliance standards.</li><li>Understanding of threat intelligence sources and their application.</li></ul>Skills<ul><li>Proficient in analyzing security logs and identifying malicious activity.</li><li>Strong understanding of network traffic analysis.</li><li>Ability to perform basic malware analysis.</li><li>Skill in using various security tools for incident investigation and response.</li><li>Good understanding of scripting languages (e.g., Python, PowerShell) for automation.</li><li>Ability to work effectively under pressure during security incidents</li></ul>Abilities<ul><li>Ability to analyze complex security events and identify root causes.</li><li>Ability to implement effective containment and remediation strategies.</li><li>Ability to correlate data from various security tools to gain a comprehensive understanding of incidents.</li><li>Ability to document security incidents clearly and concisely.</li><li>Ability to learn and adapt to new security threats and technologies.</li><li>Ability to work independently and as part of a team.</li><li>Ability to follow established procedures and guidelines</li></ul>Education, Experience, Licensure, Certification Required For The Position<ul><li>Bachelor's degree in Computer Science, Information Security, or a related field.</li><li>1-3 years of experience in a Security Operations Center (SOC) environment, with demonstrable experience in incident analysis and response</li><li>Relevant security certifications such as CompTIA CySA+, Security+, CEH, or vendor-specific certifications (e.g., Splunk Core Certified User/Power User) are desirable.</li></ul>Competencies Required To Successfully Perform The JobTechnical CompetenciesBehavioural/General Competencies<ul><li>SIEM Analysis &amp; Management</li><li>Basic Malware Analysis</li><li>Scripting for Automation (e.g., Python, PowerShell)</li><li>Network Traffic Analysis</li><li>Endpoint Detection &amp; Response (EDR) Analysis</li><li>Analytical Thinking</li><li>Problem Solving</li><li>Communication (verbal and written)</li><li>Attention to Detail</li><li>Responsible</li></ul>Job Type: Full-timeWork Location: In person

SOC Officer

The Amatriot Group

<div><div>Cyber Threat Analyst 
5 Year DoJ Contract | Chantilly, VA 
Amatriot is seeking a Cyber Threat Analyst to support a Cyber Technical Analysis Unit in 
analyzing cyber intrusion activity, digital communications, and host/network forensic artifacts in 
support of DoJ mission operations. This role is focused on cyber threat analysis, intrusion 
investigation, host-based forensic analysis, network traffic analysis, and attribution support 
within a highly sensitive operational environment. The ideal candidate will possess experience 
analyzing Splunk data, conducting host and network forensic analysis, and utilizing industrystandard 
forensic and cyber analysis tools to identify malicious activity, recover artifacts, and 
support investigative operations. 
Responsibilities 
<ul><li>Process, evaluate, and analyze digital network communications and cyber threat data to</li></ul>
identify malicious activity and support investigative operations. 
<ul><li>Conduct cyber intrusion investigations and end-to-end kill chain analysis across host and</li></ul>
network environments. 
<ul><li>Perform host-based forensic analysis leveraging Splunk and standard forensic toolsets</li></ul>
to identify indicators of compromise, attacker activity, persistence mechanisms, and 
unauthorized access. 
<ul><li>Analyze packet capture (PCAP) and NetFlow data to identify malicious communications,</li></ul>
software usage, command execution, credential activity, and network-based indicators of 
compromise. 
<ul><li>Correlate digital artifacts including IP addresses, URLs, malware indicators, system logs,</li></ul>
and user activity across multiple data sources to support attribution and investigative 
lead generation. 
<ul><li>Analyze encrypted and plaintext credentials, registry artifacts, rootkit activity, commandline</li></ul>
execution, and other system-level forensic evidence. 
<ul><li>Draft detailed technical reports and analytical findings based on cyber investigations</li></ul>
while participating in internal review and quality assurance processes. 
<ul><li>Support development and refinement of cyber analysis processes, CONOPS, SOPs,</li></ul>
and investigative methodologies. 
<ul><li>Conduct open-source and intelligence community research to maintain awareness of</li></ul>
emerging cyber threats, malware trends, and adversary tactics, techniques, and 
procedures (TTPs). 
<ul><li>Collaborate with internal teams and mission partners across the intelligence community</li></ul>
to support tactical and strategic cyber operations. 
<ul><li>Provide operational updates and analytical findings to leadership and investigative</li></ul>
stakeholders. 
Required Skills &amp; Experience 
<ul><li>Active Top Secret Clearance required, with willingness and ability to obtain a Counter</li></ul>
Intelligence (CI) Polygraph. 
<ul><li>BS/BA degree with 5+ years of relevant experience or 9 years with no degree. Advanced</li></ul>
certifications, specialized training, or equivalent hands-on experience may be considered 
in lieu of years of experience 
<ul><li>Experience performing host-based forensic analysis utilizing Splunk.</li><li>Experience analyzing network traffic, packet capture (PCAP), and NetFlow data.</li><li>Hands-on experience with industry-standard forensic tools such as:</li></ul>
o Splunk 
o EnCase 
o Magnet AXIOM 
o X-Ways Forensics 
<ul><li>Understanding of cyber intrusion methodologies, attacker kill chains, malware behavior,</li></ul>
and forensic artifact analysis. 
<ul><li>Experience correlating threat indicators and investigative data to support attribution and</li></ul>
operational analysis.</div></div>

Cyber Threat Analyst

Search 1839+ Malware analyst jobs near you this May. New roles added regularly across leading industries. Apply today.

1839 malware analyst jobs Near Me

Senior Consultant - FortiGuard Incident Response

Machine Learning Detection Engineer (Remote, East/Central)

Cybersecurity Research Engineer

Cybersecurity Research Engineer

SOC L2 Analyst

SOC Officer

Cyber Threat Analyst