Technical Consultant - Cyber Threat Hunting Specialist

It’s an exciting time to join the Threat Intelligence Team as it’s still in its infancy – so bring your experience and help us shape the team. Once we’re at full capacity, our work will touch every part of the business. So, you’ll get to know the ins and outs of Computacenter in no time.

You’ll work as part of a team of five specialists and analysts. We’ve got big plans – there are so many things we already want to do – and if you’ve got specific areas, you’re passionate about, we’ll encourage and support you to follow that.

What you’ll do

• Identify and contextualise threats to Computacenter.
• Lead briefings, informing colleagues and relevant teams to help them understand what the threat is.
• Create threat reports, intelligence reports, briefings, and presentations.
• Allocate tasks relevant to identify threats that need further investigating.
• Lead your proactive projects to identify operational, reputational, and financial threats.
• Liaise with government partners and industry experts.

What you’ll need

• Experienced in Information and Cyber Security, including a SOC.
• Experienced in common open and closed source intelligence tools and technologies.
• Experienced in adversary tactics and techniques frameworks such as Mitre ATT&CK and Killchain.
• Experienced in common SOC SIEM technology applications such as MS Sentinel.
• Experienced in KQL, with ability to formulate advanced queries.
• Experienced in investigating security breaches and security incident management.

Provide support for core CTH service lines as detailed below.

• DF – artefact/ evidence collation o DF – analysis of evidence
• DF – forensic investigation of seized assets
• DF – report writing.
• CTH – create hypothesis, generate structured plan and conduct threat hunts for given threats.
• CTH – create and maintain standard library of repeatable hunting queries to search for common attack techniques.
• CTH – generate reports on discovered threats o
• MA – Liaise with internal and external stakeholders to obtain malware samples, transferring them to the analysis environment in a secure, controlled manner.
• MA – Build suitable virtual environment for testing malware against
• MA – detonate and analyse malware using both static and dynamic techniques.
• MA – Define and disseminate findings to stakeholders.