CT- Lead Cyber Threat Hunter

$139,000 - $231,600/Yr

McKesson - Austin, TX

Full-time - Senior

Austin, TX

1-10 employees

Merchant Wholesalers, Nondurable Goods

About the position

The Lead Cyber Threat Hunter at McKesson will be a key member of the Cyber Investigations & Response Team, responsible for executing threat hunting activities across the enterprise. This role involves leading investigations into threat actors, implementing technical methodologies for threat hunting, and providing expert support for incident response and monitoring functions. The primary mission is to detect, disrupt, and eradicate threat actors from enterprise networks using data analysis, threat intelligence, and advanced security technologies.

Responsibilities

• Lead the research, analysis, and response for alerts; including log retrieval and documentation.
• Conduct analysis of network traffic and host activity across a wide array of technologies and platforms.
• Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts.
• Compile detailed investigation and analysis reports.
• Work with the Cyber Threat Intelligence (CTI) team to track threat actors and associated tactics, techniques, and procedures (TTPs) and develop countermeasures in response to those threat actors.
• Analyze malicious campaigns and evaluate effectiveness of security technologies.
• Coordinate threat hunting activities across the network leveraging intelligence from multiple internal and external sources, as well as cutting-edge security technologies.
• Perform Root Cause Analysis of security events and incidents for further enhancement of processes and detection/prevention strategies.
• Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc.

Requirements

• 10+ years of relevant cyber security experience in Threat Hunting, IT Security, Incident Response or network security with strong knowledge working in a Security Operations Center, Incident Response team, or Threat Hunting team.
• Experience with risk management, vulnerability management, threat analysis, security auditing, security monitoring, incident response and other information security practices preferred.
• Strong analytical and investigation skills & active threat hunting and adversary tracking.
• Excellent written and oral communication skills with the ability to effectively communicate with information technology professionals as well as senior management and auditors, assessors, and consultants.
• High level of personal integrity, and the ability to professionally handle confidential matters and exude the appropriate level of judgment and maturity.
• Working knowledge of root causes of malware infections and proactive mitigation.
• Working knowledge of lateral movement, footholds, and data exfiltration techniques.
• Ability to mentor and potentially independently lead a team of global Cyber Threat Hunters.

Nice-to-haves

• One or more of the following technical security certifications or equivalent: GDAT (GIAC Defending Advanced Threats), Certified Cyber Threat Hunting Professional (CCTHP), Certified Threat Intelligence Analyst (CTIA), and GIAC Cyber Threat Intelligence (GCTI).
• Master's degree in a technical field such as Computer Science, Information Security, Information Technology, Computer Engineering, or Information Systems. or equivalent degree is preferred.
• Knowledge of the underlying logic that security alerts are built upon and them when analyzing raw logs and creating new dashboards and alerts.
• Recognize complex problems, analyze situations and provide suggested/implemented resolution(s).
• Experience and knowledge of packet flow, TCP/UDP traffic, firewall technologies, IDS technologies, proxy technologies, and antivirus, spam and spyware solutions.
• Provide leadership and guidance to the team and act as a resource to the team members.
• Experience with one or more scripting languages (e.g., Python, JavaScript, Perl).
• Perform memory analysis and malware analysis.
• Experience with computer exploitation methodologies.

Benefits

• Competitive compensation package including base pay and potential bonuses.
• Annual bonus or long-term incentive opportunities.