[Hiring] Cybersecurity Consultant @The Copper River Family of Companies

Role Description

Lead or support cybersecurity incident response engagements involving ransomware, advanced persistent threats (APT), insider threats, phishing campaigns, malware infections, unauthorized access, cloud compromises, and other cyber incidents.

• Perform incident triage and determine scope and severity.
• Identify attack vectors and affected assets.
• Collect and preserve forensic evidence.
• Perform root cause analysis.
• Coordinate containment activities.
• Support eradication of adversary presence.
• Restore systems to secure operational status.
• Develop incident timelines.
• Produce executive and technical incident reports.
• Recommend security improvements to prevent recurrence.

Cyber Hunt Operations

• Conduct proactive threat hunting activities designed to identify adversaries before significant impact occurs.
• Develop hunt hypotheses based on current intelligence.
• Analyze endpoint, network, cloud, identity, and application logs.
• Identify Indicators of Compromise (IOCs) and Indicators of Attack (IOAs).
• Detect persistence mechanisms.
• Identify lateral movement.
• Investigate privilege escalation.
• Hunt for known threat actor Tactics, Techniques, and Procedures (TTPs).
• Leverage MITRE ATT&CK methodologies.
• Produce actionable hunt findings.

Incident Handling & Event Management (IHEM)

• Support enterprise Incident Handling and Event Management capabilities consistent with NIST guidance and industry best practices.
• Monitor security events and alerts.
• Validate and declare security incidents.
• Perform event analysis and prioritization.
• Coordinate incident response activities.
• Conduct technical investigations.
• Execute containment procedures.
• Support remediation efforts.
• Validate recovery activities.
• Document lessons learned.
• Improve incident response processes.

Digital Forensics & Analysis

• Support forensic investigations involving:
• Windows
• Linux
• Cloud environments
• Active Directory
• Microsoft 365
• Azure
• AWS
• Containers
• Virtual infrastructure
• Experience with:
• Memory analysis
• Disk analysis
• Log analysis
• Timeline reconstruction
• Registry analysis
• Malware triage

Security Technologies

• Consultants should have practical experience with one or more of the following:
• Splunk
• Microsoft Sentinel
• CrowdStrike Falcon
• Microsoft Defender
• Elastic
• QRadar
• Palo Alto Cortex
• Trellix
• Carbon Black
• Rapid7
• Tanium
• Tenable
• Qualys
• AWS Security Services
• Azure Security Center
• Microsoft Defender XDR
• EDR/XDR platforms

Requirements

• Minimum 7 years of cybersecurity experience.
• Minimum 5 years supporting Incident Response or Security Operations Center (SOC) environments.
• Experience responding to live cybersecurity incidents.
• Experience performing enterprise threat hunting.
• Strong understanding of:
• NIST Cybersecurity Framework
• NIST SP 800-61 Computer Security Incident Handling Guide
• NIST SP 800-53
• MITRE ATT&CK Framework
• Cyber Kill Chain
• Zero Trust Architecture
• Experience analyzing:
• Windows Event Logs
• Sysmon
• Active Directory
• DNS
• Firewall logs
• Authentication logs
• EDR telemetry
• Cloud audit logs
• Excellent written and verbal communication skills.
• Ability to explain technical findings to executive leadership.

Desired Qualifications

• One or more of the following certifications:
• CISSP
• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Enterprise Defender (GCED)
• Certified Ethical Hacker (CEH)
• CompTIA CySA+
• CompTIA Security+
• Splunk Certified Architect
• Splunk Enterprise Security Certified Admin
• Microsoft Certified Security Operations Analyst (SC-200)
• Microsoft Cybersecurity Architect (SC-100)
• AWS Security Specialty
• Certified Cloud Security Professional (CCSP)

Preferred Experience

• Experience supporting:
• Federal Civilian Agencies
• Department of Defense
• Intelligence Community
• Critical Infrastructure
• Healthcare
• Financial Services
• Energy Sector
• Experience with:
• Continuous Diagnostics and Mitigation (CDM)
• Continuous Monitoring
• Threat Intelligence
• Insider Threat
• Vulnerability Management
• Malware Analysis
• Digital Forensics
• Cloud Incident Response
• Identity-based attacks
• Zero Trust implementations

Availability Requirements

• Respond to urgent requests within agreed Service Level Agreements (SLAs).
• Participate in after-hours, weekend, and holiday incident response activities.
• Support remote engagements nationwide.
• Participate in surge support during major cybersecurity incidents.

Key Competencies

• Incident Response Leadership
• Cyber Threat Hunting
• Digital Forensics
• Malware Investigation
• Log Analysis
• Enterprise Security Monitoring
• SIEM Operations
• Executive Communication
• Technical Documentation
• Problem Solving
• Crisis Management
• Team Collaboration

Deliverables

• Incident Response Reports
• Executive Briefings
• Threat Hunt Reports
• Root Cause Analysis Reports
• Lessons Learned Documentation
• Indicators of Compromise (IOC) Reports
• Security Recommendations
• Recovery Validation Reports
• Remediation Plans

Position Pay Range

$150 — $150 USD