Senior Incident Analyst, Cyber Threat Intelligence- Charlotte,NC

Credit Karma is a mission-driven company, focused on championing financial progress for our more than 100 million members in the U.S., Canada and U.K. While we're best known for pioneering free credit scores, our members turn to us for tips as they work on their financial goals, including helping them monitor their credit, identity monitoring, searching for credit cards, shopping for loans (car, home and personal), filing their taxes with Credit Karma Tax and growing their savings* -- all for free. Credit Karma has grown significantly through the years: we've added more than 70 million members in the last five years alone and now have more than 1,100 employees across our offices in San Francisco, Charlotte, Los Angeles, Leeds, London and soon Oakland. Security is a core value at Credit Karma. We help millions of people better manage their credit. Safeguarding their sensitive information is critical to our continued success. From the CEO down to each individual engineer, everyone views security as a personal responsibility. Your unique mission as a security engineer working in the Credit Karma SOC is to mine a deep data set of security event information for useful signals and feed the results into automated actions and infrastructure changes. *Banking services provided by MVB Bank, Inc., Member FDIC

What you’ll do:

Primary duty is responding to security events and incidents
Incident Response activities will include, but are not limited to, triaging security events, network and endpoint forensic analysis, malware reverse engineering, threat hunting, vulnerability escalation, and resolving security incidents from detection to remediation
Create and implement standard operating procedures and processes to help streamline investigations, daily. monitoring and analysis research
Engage with partners in engineering, IT, and operations to respond to and remediate events
Secondary duty will assist build out of Cyber Threat Intelligence capability
Mine open data sources to identify potential cyber threats, targets of interest, and timeframes for attack
Identify, profile, and track threat actors that may be targeting our environment
Carry out threat hunting campaigns and missions and coordination and execution of purple teaming exercises

What’s great about the role:

Carrying out two positive missions at the same time: helping people take back control of their credit and helping to keep their personal information safe
Solving frontier security problems at scale in a highly technology-focused team
Spending zero minutes convincing anyone why security is important - we all understand that very well already!

What we are looking for:

5+ years experience in working in cyber security operations (CSOC, SOC, CIRT, CSIRT) in enterprise environments
Strong knowledge of the following tool categories: Network Intrusion Detection Systems (NIDS)Endpoint Detection & Response (EDR) Security Information & Event Management (SIEM)
Experience with Network Security Monitoring (NSM) methodologies and Ethical Hacking or Red Team engagements
Experience with Cyber Kill Chain framework and Diamond Model for intrusion analysis
Experience with MITRE ATT&CK Framework
Experience with host-centric tools for forensic collection and analysis (SleuthKit, Volatility Framework, FTK, Encase, etc.)
Network Forensics and/or Network Security Monitoring (NSM) tools (Snort, Bro-IDS, PCAP, tcpdump, etc.) analysis techniques (alert, flow/session and PCAP analysis) Vulnerability scanners such as: Qualys, Nessus, Metasploit, Rapid7, etc
Experience with Languages such as; Python, Java, Scala, PowerShell, Bash, etc. and also with SAAS, PAAS, IAAS, public and private cloud technologies such as AWS or GCP, Containerization technology such as Docker, Kubernetes

Current Job Openings

Engineering

Operations