Note: The job is a remote job and is open to candidates in USA. Exostar is a company that specializes in cloud-based platforms for the Aerospace and Defense and Life Sciences industries. They are seeking an Information Security Engineer to support a highly secure suite of services, focusing on various information security functions and incident response.
Responsibilities
- Monitoring, triaging, deployment, and administration of security operation tools (ex. EDR, AV, email filtering, DLP, vulnerability scanners, and whitelisting)
- Ability to import and manage IOCs from various threat sources
- SIEM administration and engineering, including refining and building dashboards, managing ingest sources and licensing, monitoring for incidents and operational events, health of indexers and deployment agents, and deploying new infrastructure
- Perform Azure security monitoring including review, triage, and respond to Defender, Azure Monitor, and AAD alerts
- Threat intelligence research support including notification on emerging threats and providing timely threat data in Exostar format
- Vulnerability management support using scanning tools such as Tenable/Web application scanners, communicating results to stakeholders, and supporting remediation activities
- Threat hunting including adhoc monthly and formalized quarterly exercises with reporting. Threat hunting exercises are performed with relevance to the industry and security landscape
- Proofpoint monitoring and email filtering including mailbox user sync, review, release of legitimate emails from quarantine, reviewing inbound Spam and CIRT emails from the user population
- Security engineering, consisting of maintaining FIM agents, legacy antivirus health/alert monitoring, triaging alerts, false positives, and true positives
- Advise on procurement for new solutions which support Exostar’s Security Tools Suite
- Provide IR escalation support, consisting of "Tier 2-3" incident response and forensics capabilities leveraging industry-standard methodologies (e.g., US-CIRT, NIST, MITRE) and tools
- Support with miscellaneous documentation tasks including the compilation of threat metrics, drafting SOPs, and providing Executive-level status reports
- Audit and Compliance support, including assistance with providing artifacts demonstrating security control implementation, answer questions and customer questionnaires, and performing monthly User Account Reviews
- Perform Configuration Management support for product teams and conduct Change Control review
Skills
- 7+ years of experience in information security
- Strong background in security operations, incident response, threat detection, and monitoring
- Demonstrated experience securing Azure and Microsoft 365 environments in regulated or enterprise contexts
- Experience with Multi-vendor environments including Windows Domains, Active Directory, and Linux-based environments
- Experience using on-premise and Azure cloud-native security tools (e.g. IDS, Firewalls, Splunk, Sentinel, Defender, EDR/NGAV, SIEM, vulnerability scanners, legacy and next-generation antivirus, email filtering, DLP, software whitelisting)
- Scripting and query language knowledge (Python, Splunk Query Language, KQL)
- Security Monitoring and Intrusion Detection (e.g. Log correlation and analysis, Incident Response, Forensics)
- Vulnerability Scanning and Remediation (Infrastructure, Application, and Database)
- Information Security Threat/Risk Assessment
- Demonstrated ability to understand and respond to complex business requirements
- Demonstrated ability in strong verbal and written communication skills to interface with technical and business stakeholders
- U.S. Citizens only- Due to customer requirements, U.S. Citizenship is required. Ability to gain and maintain Trusted Role is required
- Bachelor's degree in an IT or Security-related discipline or equivalent experience
- CISSP and other security/technical certifications are a plus
- Scripting and Querying Experience (Python, PERL, Ruby, Bash, SQL, KQL)
- Experience with Data Loss Prevention (DLP) and Whitelisting processes and tools
- Identity Federation Technologies (SAML, etc.)
- Business Continuity and Disaster Recovery planning
- Data Loss Prevention (DLP)
- Data Labeling and Information Rights Management
Benefits
- Health insurance (medical, dental, vision, prescription)
- Basic Life & AD&D insurance
- EAP
- Flexible Spending Accounts
- 401(k) matching
- Flexible time off and sick leave
- Training and educational assistance
- Social and community-building events
Company Overview