Threat Hunting Analyst (TS/SCI)

Application window is expected to close by 04/30/2025.

Job posting may be removed earlier if the position is filled or if enough applications are received.

Existing or previous Government Security Clearance is required with ability to obtain TS/SCI.

Work must be completed onsite in a secure space at our RTP office. No Hybrid or Remote.

Meet the Team

Cisco's Security Visibility and Incident Command (SVIC) forms part of the investigative branch of Cisco's Security and Trust Organization (S&TO) and is Cisco's cyber investigations and forensics team. It provides Cisco with tailored security monitoring services in order to protect Cisco from cyber-attacks and the loss of its intellectual assets. The primary mission of SVIC is to help ensure company, system, and data preservation by performing comprehensive investigations into computer security incidents, and to give to the prevention of such incidents by engaging in dedicated threat assessment, mitigation planning, incident trend analysis, and security architecture review.

The SVIC is a highly-functioning, diverse, and globally distributed group of best-in-class professionals from various technical backgrounds. We're Open-Source Software contributors, technical authors, tool builders, DFIR community members, lock pickers, makers, and breakers.

Your Impact

SVIC is looking for an experienced security professional to join the Computer Security Incident Response Team. This is an opportunity to contribute to a highly transparent security operations function with global impact upon Cisco, its diversified business, business units, service ventures, partners, and customers. We are looking for a motivated individual with good team fit and the ability to focus on data security and incident analysis. You have a very strong interest in complex problem solving, ability to challenge assumptions, consider alternative perspectives, nimble thinking and perform in high-stress situations, while operating exceedingly well in a strong, tight-knit, collaborative team environment.

Responsibilities Include

• Document cases, procedures, analysis, and investigations accurately and thoroughly (including best-practice documentation).
• Assist with setup and tuning of multiple security monitoring products and data feeds
• Collaborate with data source SMEs in SVIC and InfoSec to enhance, improve, or modify cloud (IaaS, SaaS, etc) based security detection and response.
• Update, modify, and enhance existing programs used for security detection and response.
• Develop documentation on all custom solutions.
• Identify attackers and their methods but also use your IT and networking expertise to improve detection logic.
• Occasional travel (<10%)

Attack Analysis

• Attacker Tools, TTPs
• Log Analysis (System, Firewall, Application

Cyber Threat Intelligence

• Threat Hunting
• Intelligence Analysis
• Attacker Methodology
• Industry Peer Collaboration & Information Sharing

Incident/Investigations Handling

• CyberSecurity Impact Assessment
• CyberSecurity Problem Management
• Automation/SOAR
• Root Cause ID / LTF

Minimum Qualifications

• 4 + years of Cybersecurity or IT security related work experience.
• Python scripting/coding experience
• Experience with any three or more of the following tools: Splunk, CSE(AMP4E), Network AMP, WSA, Firepower IPS, NGFW, ESA, CTA, Threat-Grid, Stealthwatch, Umbrella, SecureX, OSQuery, Threat-Quotient, MISP, Recorded-Future, Volatility, Powershell, Wireshark, Encase, Tableau, TheHive
• Must have Experience with Log Analysis (System, Firewall, Application)

Preferred Qualifications

• Good technical skills in a variety of operating system, languages, and databases
• Experience with - Go, Java, JavaScript, SQL, MySQL, STIX/TAXII AND/OR MITRE ATT&CK
• Certifications GSEC, GCIA, GISF, GCED, GCFA, GCFE, GREM, GCTI, GASF, GCEH, CISSP, CCSP OR SSCP
• Cloud experience with AWS or Azure.
• Agility and willingness to deal with a high level of ambiguity and change
• Flexibility - willingness to pitch in where needed across program and team

# WeAreCisco

#WeAreCisco where every individual brings their unique skills and perspectives together to pursue our purpose of powering an inclusive future for all.

Our passion is connection-we celebrate our employees' diverse set of backgrounds and focus on unlocking potential. Cisconians often experience one company, many careers where learning and development are encouraged and supported at every stage. Our technology, tools, and culture pioneered hybrid work trends, allowing all to not only give their best, but be their best.

We understand our outstanding opportunity to bring communities together and at the heart of that is our people. One-third of Cisconians collaborate in our 30 employee resource organizations, called Inclusive Communities, to connect, foster belonging, learn to be informed allies, and make a difference. Dedicated paid time off to volunteer-80 hours each year-allows us to give back to causes we are passionate about, and nearly 86% do!

Our purpose, driven by our people, is what makes us the worldwide leader in technology that powers the internet. Helping our customers reimagine their applications, secure their enterprise, transform their infrastructure, and meet their sustainability goals is what we do best. We ensure that every step we take is a step towards a more inclusive future for all. Take your next step and be you, with us!