Title: Threat Hunter Analyst
Company: R-Vision
Location: Moscow
Experience: 3 to 6 years
R-Vision is a developer of reliable digitalization and cybersecurity systems. Since 2011, we have been creating technologies that help organizations effectively counter cyber threats, maintain the reliability of IT infrastructure, and ensure digital transformation.
Our solutions are used in the largest banks, government organizations, the oil and gas industry, media, energy, metallurgy, industry, and other business segments.
We are constantly developing existing products, creating new services, and carefully supporting the integration of our solutions into client infrastructure.
Thanks to teamwork and the contribution of each employee, we achieve significant results.
Tasks:
- Research current threats, tactics, techniques, and procedures (TTP) of APTs, analyze modern cyberattack methods;
- Develop threat detection algorithms: create detection rules and scenarios;
- Develop response scenarios and recommendations for handling information security incidents;
- Participate in project and other activities as an information security expert;
- Develop company products, improving the quality of threat detection and incident response mechanisms;
- Automate threat analysis and detection processes, develop own expertise, and share knowledge within the team.
We expect from you:
- Knowledge of modern attacker tactics and techniques, main attack vectors, and methods for their detection;
- Knowledge of the principles of operation of network protocols, operating systems, and web applications;
- Experience using or understanding the principles of operation of Threat Intelligence (TI) class solutions;
- Ability to analyze event logs of various information systems, security tools, OS, network equipment, DBMS, applications, etc.;
- Experience in investigating information security incidents;
- Ability to emulate APT actions in a test environment to verify detection scenarios;
- Experience in developing complex correlation rules and detection scenarios for SIEM;
- Experience in administering Linux/Unix and Windows;
- Experience in developing scripts in Bash, Python, and PowerShell.
Will be a plus:
- Professional certifications (OCSP, SANS, CISSP);
- Experience participating in CTF or conducting Pentests;
- Understanding of the attack lifecycle (Cyber Kill Chain, MITRE ATT&CK);
- Experience working with Kubernetes, Docker, VMware;
- Experience working in an SOC;
- Experience with public speaking and preparing technical materials;
- Higher education in IT and/or Information Security.
We offer:
- Work in a hybrid format in an 'A' class office within walking distance of Rimskaya/Ploshchad Ilyicha metro stations or remote work within the Russian Federation;
- Decent compensation corresponding to professional level and competencies;
- Accredited IT company status with all its benefits;
- Voluntary medical insurance with dental and hospitalization coverage throughout Russia, accident insurance, travel insurance for trips abroad, veterinary support;
- 100% sick leave compensation, +10 additional days per year for sick leave;
- Regular feedback exchange through a semi-annual Performance Review system;
- Opportunities for training and professional development: corporate library, mentorship, internal knowledge-sharing meetups, public speaking practice, opportunity to participate in content creation for professional communities;
- Corporate discount and privileges program;
- Developed corporate culture: open communication, online and offline meetings, interest clubs, sports activities, and support for employee initiatives.
Despite rapid growth, we approach specialist selection thoroughly, which has allowed us to assemble a professional and cohesive team.
**Join us!
