工作職責(zé)： 1.代表公司主動推動威脅搜尋和分析 Proactively drive threat hunting and analysis 2. 利用內(nèi)部和外部資源研究各種攻擊者和攻擊基礎(chǔ)設(shè)施的威脅、漏洞和情報(bào)。 Leverage internal and external rescources to research threats, vulnerabilities, and intelligence on various attackers and attack infrastructure. 3. 在公司網(wǎng)絡(luò)和端點(diǎn)上積極尋找風(fēng)險(xiǎn)ior指標(biāo)和apt戰(zhàn)術(shù)、技術(shù)和程序ttp。 Actively hunt for indicators of risk ior and apt tactics, techniques, and procedures ttp on skrykers networks and endpoints. 4. 識別和跟蹤威脅參與者組、他們的技術(shù)、工具和程序，同時(shí)保持對高級持久性威脅的工具和最｜｜佳實(shí)踐的最新知識 Identify and track threat actor groups, their techniques, tools, and procedures ttp while maintaining current knowledge of tools and best practices of advanced persistent threats apt 5. 使用MITRE ATT&CK框架分析惡意活動并評估安全技術(shù)的有效性。 Use the MITRE ATT&CK framework to analyze malicious campaigns and evaluate the effectiveness of secruity technologies. 6. 創(chuàng)建詳細(xì)的事件報(bào)告，提供專家分析調(diào)查支持，并與全球團(tuán)隊(duì)合作總結(jié)經(jīng)驗(yàn)教訓(xùn) Create detailed incident reports, provide expert analytic investigative support, and contribute to lessons learned in collaboration with global cirt team 7. 報(bào)告調(diào)查結(jié)果，并建議系統(tǒng)調(diào)整/定制和數(shù)據(jù)收集改進(jìn)。 Report on findings and recommend system tuning/customization and date collection improvements. 要求： 1. 計(jì)算機(jī)信息安全或信息系統(tǒng)相關(guān)專業(yè)本科 Bs in computer informatoin security or information system of equivatent 2. 至少需要GIAC的一個(gè)安全認(rèn)證，如CEH、CCTHP、CISSP、CISM、CRISC。 At least one of the security certifications such as CEH, CCTHP, CISSP, CISM, CRISC, of GIAC required. 3. 2以上年信息安全、網(wǎng)絡(luò)安全或類似職能領(lǐng)域的工作經(jīng)驗(yàn)。 2 years experience in information security, cyber security, or similiar functional areas. 4. 了解常見的攻擊向量、ddos攻擊、網(wǎng)絡(luò)釣魚、網(wǎng)絡(luò)攻擊和惡意軟件。 Understanding of common attack vectors, ddos attacks, phishing, web attacks, and malware. 5. 事件響應(yīng)和威脅搜尋的背景。 Background within incident response&threat hunting. 6. 有貫入試驗(yàn)經(jīng)驗(yàn)。 Experiences of penetation testing. 7. 網(wǎng)絡(luò)背景、搜索漏洞、日志審查。 Background of network, searching vulnerabilities, log review. 8. 熟悉安全工具，如ORadar/Splunk、PA防火墻、qualys、MDO等。 Familiar with security tools such as ORadar/Splunk, PA firewall, qualys, MDO, etc. 9. 具有解決復(fù)雜問題和確定信息安全解決方案以應(yīng)對具有挑戰(zhàn)性的業(yè)務(wù)問題的能力、管理/組織、報(bào)告活動進(jìn)展的能力、較強(qiáng)的分析能力 Domonstrated ability to solve complex problems and indentify information security solutions to challenging business problems, to manage/organize, to report on progress of activities,strong analytical skills 10.能夠用英語寫作和交流 Able to write and communicate in English