Responsibilities:

• Review, validation, and triage of alerts and technical analysis of log data from a diverse inventory of sensors, correlated signature logic, and threat intelligence sources. 

• Assess the impact of security events by leveraging host, cloud, and network-based indicators and evidence to deliver actionable incident escalations. 

• Act as the initial point of escalation for cyber security events and drive investigation to completion. 

• Perform accurate and in-depth near real-time analysis of correlated logs and alerts from a multitude of devices with a focus on the classification of events that constitute security incidents. 

• Proactively and iteratively search through collected telemetry to detect and isolate advanced threats that evade existing security solutions. 

• Assist in the development of incident handling policies and procedures to align with global industry standards. 

• Engage in the continuous research of emerging threats and apply appropriate countermeasures within the context of a rapidly changing environment. 

• Serve as a subject matter expert in the mechanism and analysis of observed malicious activity. 

• Perform consistent tuning of alerting and provide support to junior team members in detection engineering 

• Maintain security infrastructure and take accountability for ensuring the tooling configuration is updated as required 

• Assist on projects as and when required 

Preferred Qualifications:

• Bachelor’s Degree (or equivalent professional/military experience)  

• 3+ years of experience in Incident Response, Incident Analysis, or Computer Forensics  

• Familiarity with industry standard security devices and their configuration  

• Exposure to the analysis of malicious code to explore infection and propagation mechanisms  

• Experience leveraging scripting languages to solve for information security use cases  

• Outstanding work ethic with a passion for Cyber Security  

• Certifications: One of more of the following certifications are preferred (GCFA, GCIA, GCIH, GCFA, GNFA, GREM, OSCP, or CEH)  

• Experience working in a SaaS environment operating on a global scale. 

• Experience in the legal space and with a high understanding of e-discovery and litigation. 

• Experience working with cloud environments such as Azure, GCP, or AWS. 

Minimum Qualifications:

• Strong cyber incident response skills (such as: Network forensics, memory forensics, and/or packet analysis)  

• Working knowledge of TCP/IP, network services, cryptography and web application attacks  

• Ability to collaborate within a cross-functional team to execute on high-level objectives and drive the maturation of Relativity’s security posture  

• Understanding of methods and tools utilized by attackers to access private systems and data  

• Capability to independently manage the prioritization of complex events  

• Understanding of infection mechanisms, malicious behavior, exploitation techniques, and mitigating controls.