Threat Hunting Researcher – Unit
Company | Palo Alto Networks |
---|---|
Location | Santa Clara, CA, USA |
Salary | $Not Provided – $Not Provided |
Type | Full-Time |
Degrees | |
Experience Level | Mid Level, Senior |
Requirements
- Understanding the evolving threat landscape, including attack tools, tactics, and techniques, as well as networking and security fundamentals
- Experience investigating targeted, sophisticated, and/or hidden threats in both endpoints and networks
- 4+ years of relevant experience with a proven track record in cybersecurity research, specializing in either APTs or cybercrime, but with the ability to address the broader threat landscape
- Background in writing detections/hunting queries
- Understanding of APT operations, including attack vectors, propagation, data exfiltration, lateral movement, persistence mechanisms, and more
- Familiarity with organizational cybersecurity measures, including protective tools and remediation techniques
- Excellent written and oral communication skills in English
- Strong attention to detail
- Knowledge of advanced threat hunting methodologies and the ability to develop novel techniques
- Ability to analyze and understand the infrastructure of malicious campaigns
- Self-starter who can work independently and adapt to changing priorities
Responsibilities
- Proactively search for signs of malicious activity within an organization’s network
- Use advanced tools and methodologies to identify anomalies and potential threats
- Engage in research and experimentation to develop new hunting techniques
- Work closely with other teams, such as Incident Response, Threat Intelligence, customers, and cybersecurity leadership, to share findings and coordinate response efforts
- Perform threat hunting activities on a wide variety of data sources
- Build hypotheses, execute manual hunting techniques, gather and analyze results, perform forensic activities, and deliver reports
- Collaborate with multiple research and development groups
Preferred Qualifications
- Experience in an Incident Response environment is a plus
- Proficiency in Python and SQL is beneficial
- Familiarity with reverse engineering is advantageous
- Experience in writing technical blog posts and analysis reports