Senior Threat Hunting Analyst

LSEG

LSEG is your trusted global financial markets infrastructure and data provider. Discover how we deliver value for our customers.

LSEG Cyber security operations is a central function employing people, process and technology to proactively prevent, detect and respond to cyber security incidents. Security operations spans multiple pillars including cyber threat intelligence, cyber threat detection, data loss prevention, cyber incident response and cyber threat hunting.

This role sits within the cyber threat hunting pillar and is responsible for driving a proactive hunt based approach to cyber defense, leveraging large disparate data sets, analytical techniques and leveraging of deep subject matter expertise across a broad range of disciplines to help identify rare, unknown and anomalous behaviours.

Key Responsibilities

• Perform intelligence led proactive threat hunts across the estate, utilising a range of tooling available, and focusing hunts on relevant behavioural tactics, techniques, and procedures (TTPs) identified as potential threats to the organisation.
• Contribute to detection engineering initiatives by identifying opportunities for, and implementation of new detections as an output of threat hunts completed.
• Support other functions within security operations by responding to hunt requests and by applying your expertise in advanced actors and TTPs for ongoing incidents, working closely with our incident responders.
• Research new attack behaviours and TTPs used by threat actors, leading to new hunting and detection opportunities.
• Assist in the development and maturity of the threat hunting process and team through development of cutting edge hunting techniques and introduction of automation into the threat hunting process.
• Develop threat hunting hypothesis in collaboration with the threat intelligence team, helping to track relevant threat actors, campaigns and emerging threats and the TTPs they use.
• Cross-train and mentor wider analyst team in the development of threat hunting.
• Represent threat hunting to the wider information security team, and to the wider business, including senior stakeholders, through reporting, presentations and knowledge sharing sessions.

Technical / job functional knowledge

• Experience within cyber security operations as either an incident responder, threat hunter, threat intelligence analyst, or similar role.
• Extensive experience in various security tooling across endpoint, cloud and network, including XDR/EDR technology, SIEM, AWS CloudTrail, Azure Sentinel, IDS/IPS.
• Proficiency in multiple query languages such as Splunk or KQL, with an ability to manipulate and analyse large data sets.
• Expertise in formulating threat hunting hypotheses and working with available data sets to determine conclusions.
• Solid understanding of current TTPs used by threat actors and an ability to replicate behaviours in a lab environment to generate telemetry.
• Direct experience working with the Mitre ATT&CK Framework or similar, with an ability to utilise the framework to identify detection gaps for threat hunting.
• Strong competence being able to quickly respond to emerging threats, showcasing an ability to develop and perform hunts, while working under strict deadlines.

Personal skills and capabilities

• Able to operate autonomously and identify opportunities to deliver impactful results.
• Curiosity and a desire to gain knowledge.
• Ability to work in a fast-paced environment, whilst remaining calm under pressure.
• Strong verbal and written communication and collaboration skills.
• Preferred competence with one or more programming/scripting languages, such as Python, Go, Rust or similar.
• Previous experience working with automation pipelines, and utilising Jupyter notebooks.

#J-18808-Ljbffr