Cybersecurity Specialist, Detection Validation

Job Description

Cybersecurity Specialist, Detection Validation - 6-Month Contract

EA Security and The Challenge Ahead:

From nation states to financially motivated cyber threats to disgruntled players, EA has a unique and ever-changing threat landscape. It is the job of the Threat Intelligence Unit to stay ahead of these adversaries, to understand their tactics and make sure their attacks are not successful against our networks.

Through analysis of attacks, we can develop detections to identify attacker techniques. You will help ensure that the detections created are effective throughout their lifecycle. You will work with several important individuals and teams including IR Operations, SOC, IR Engineering, and Red Team to perform detection validation work using technologies such as AttackIQ or manually as required.

What a Detection Validation Expert does at EA:

Primary Responsibilities

Initially:
• Use AttackIQ to create detection validators for functional detections. Splunk use cases are up next. S1 validators have been created by the team.
• Implement and improve the existing quarterly detection validation cycle.
• Work with team members to run periodic Attack IQ test cycles to identify issues with detections and identify gaps.
• Run manual tests for detections that are not incorporated into AttackIQ.

Future work:
• Work with engineering team on the care on feed of the AttackIQ platform.
• Implement new features from AttackIQ as necessary to increase efficiency for detection validation work.
• Support with Purple teamwork applying AttackIQ and other methods.
• Ensure that the detection validation work ties in with Threat Intelligence.

Required Experience:

You will have one or more of the following:
• Hands-on experience with AttackIQ or a similar technology.
• Experience doing purple teamwork.
• 5+ years of experience with Cyber Security and working within a Security function
• Some experience performing threat intelligence tasks to include adversary profiling and extraction of TTPs to create detections against.

Also, You:
• Enjoy solving problems and like to learn new technical and non-technical analysis techniques to overcome problems
• Understand in areas such as Networking, Operating systems, Computer Architecture

Jobcode: Reference SBJ-rb3oek-18-221-187-121-42 in your application.