We Are:Our Cyber Investigation and Forensic Response (CIFR) practice is rapidly growing, and we are hiring mid to very senior level professionals to work with our F500 enterprise customers. With our recent acquisitions we continue to enhance our incident response, threat hunting, forensics, threat intelligence, and purple teaming capabilities.You Are: With Accenture Security, you will be part of a specialized team to respond to some of the largest and most complex data breaches around the world, as well as conduct cyber threat hunting in some of the most complex business environments, leveraging a variety of tools and techniques. You will work in a fast-paced and highly collaborative environment along with a diverse team of talent, in support of one mission – providing expert incident response services to Accenture customers.The Work:The Incident Response Cyber Threat Intelligence Specialist (IR CTI) position is a hybrid role designed to provide embedded tactical intelligence support to CIFR investigations. The ideal candidate will have previous incident response and computer forensics experience, as well as significant experience performing cyber threat intelligence work. You will serve as the conduit between Accenture Security’s CIFR and Cyber Threat Intelligence (CTI) teams, leveraging CTI capabilities and knowledge to enhance CIFR investigations, and in turn providing data from CIFR engagements to further enrich the CTI knowledge base. In this role, you will work side by side with CIFR investigators, using your expertise to help enhance and accelerate successful resolution of IR efforts for our customers.Job Functions
Support end-to-end incident response investigations with Accenture’s customers
Support CIFR efforts to identify and investigate intrusions to determine the cause and extent of the breach, by leveraging EDR solutions and threat intelligence sources
Hunt for and identify threat actor groups and their techniques, tools and processes
Identify attacker tools, tactics and procedures to develop IOCs
Support threat hunting efforts across customer’s networks with indicators of compromise, hunting for evidence of a compromise
Analyze adversarial IOCs and their respective tactics, techniques and procedures (TTPs) to provide unique insight into current and emerging threat groups and campaigns, and generate actionable intelligence
Participate in the drafting and ultimate dissemination of finished tactical and operational threat intelligence products (reports, briefings, etc.)
Develop and continuously tune detection signatures (e.g., YARA and Snort signatures) for both immediate client consumption and to maintain visibility into adversarial malware variants and tooling.
Collect, analyze, and provide an informed assessment of technical IOCs gathered during CIFR engagements to better understand incidents and help refine detection and response efforts.
Participate in drafting of comprehensive and accurate oral and written reports and presentations for both technical and executive audiences
Effectively communicate and interface with customers, both technically and strategically from the executive level, to customers stakeholders and legal counsel
Support engagement delivery from kickoff through remediation, either on premises or remote, depending on customer requirements
Here’s what you need
Minimum 2 years of comparable experience/d etailed knowledge of Windows & Unix based operating systems and administrative tools, W indows disk and memory forensics, Unix or Linux disk and memory forensics , and Static and dynamic malware analysis
Minimum 2 years of experience tracking advanced persistent threats (APTs) and targeted cyber-crime threat campaigns, including but not limited to their associated TTPs and malicious tools.
Minimum 2 years of comparable experience/t horough understanding of cyber security operations, security monitoring, EDR and SIEM tools, to include Falcon, and Splunk
Bachelor's degree or equivalent (minimum 12 years) work experience. (If Associate Degree, must have minimum 6 years work experience)
Travel will be required for this role. The amount of travel will vary from 0 to 100% depending on business need and client requirements.
Bonus Points is you have
Degree in Computer Engineering, Computer Science, Cyber Security, Information Security or related disciplines
Security certifications: CISSP, SANS GIAC (GREM, GCFA, GCIH), OSCP
Network traffic and protocol analysis utilizing tools such as Wireshark
Applied knowledge of security controls such as authentication and identity management, security enhanced network architectures and application-based controls (including Windows, Unix, and network equipment)
Minimum 2 years of comparable experience /e xpert knowledge of forensic file system and memory techniques and use of the most commonly used toolsets, such as EnCase and FTK Suite
Minimum 2 years of comparable experience/ d eep technical knowledge of methods utilized for evidence collection, maintenance of chain of custody and associated documentation, evidence storage and analysis, and evidentiary reporting
Minimum 2 years of comparable experience with IDA Pro, OllyDbg, other disassemblers/debuggers
Excellent time management, writing and communication skills
Pay Transparency Info for Job Postings:Compensation at Accenture varies depending on a wide array of factors, which may include but are not limited to the specific office location, role, skill set, and level of experience. As required by local law, Accenture provides a reasonable range of compensation for roles that may be hired in California, Colorado, District of Columbia, Maryland, New York or Washington as set forth below.We accept applications on an on-going basis and there is no fixed deadline to apply.Information on benefits is here. (https://www.accenture.com/us-en/careers/local/total-rewards) Role Location Annual Salary RangeCalifornia $63,200 to $188,600Colorado $63,200 to $163,000District of Columbia $67,300 to $173,500New York $58,500 to $188,600Maryland $58,500 to $150,900Washington $67,300 to $173,500What We BelieveWe have an unwavering commitment to diversity with the aim that every one of our people has a full sense of belonging within our organization. As a business imperative, every person at Accenture has the responsibility to create and sustain an inclusive environment.Inclusion and diversity are fundamental to our culture and core values. Our rich diversity makes us more innovative and more creative, which helps us better serve our clients and our communities. Read more here (https://www.accenture.com/us-en/about/inclusion-diversity/us-workforce) Equal Employment Opportunity StatementAccenture is an Equal Opportunity Employer. We believe that no one should be discriminated against because of their differences, such as age, disability, ethnicity, gender, gender identity and expression, religion or sexual orientation.All employment decisions shall be made without regard to age, race, creed, color, religion, sex, national origin, ancestry, disability status, veteran status, sexual orientation, gender identity or expression, genetic information, marital status, citizenship status or any other basis as protected by federal, state, or local law.Accenture is committed to providing veteran employment opportunities to our service men and women.For details, view a copy of the Accenture Equal Employment Opportunity and Affirmative Action Policy Statement (https://www.accenture.com/content/dam/accenture/final/accenture-com/document/Annual-Policy-Statement-Regarding-EEO-2023-Applicant.pdf#zoom=50) .Requesting An AccommodationAccenture is committed to providing equal employment opportunities for persons with disabilities or religious observances, including reasonable accommodation when needed. If you are hired by Accenture and require accommodation to perform the essential functions of your role, you will be asked to participate in our reasonable accommodation process. Accommodations made to facilitate the recruiting process are not a guarantee of future or continued accommodations once hired.If you would like to be considered for employment opportunities with Accenture and have accommodation needs for a disability or religious observance, please call us toll free at 1 (877) 889-9009, send us an email (https://www.accenture.com/us-en/about/contact-us) or speak with your recruiter.Other Employment StatementsApplicants for employment in the US must have work authorization that does not now or in the future require sponsorship of a visa for employment authorization in the United States.Candidates who are currently employed by a client of Accenture or an affiliated Accenture business may not be eligible for consideration.Job candidates will not be obligated to disclose sealed or expunged records of conviction or arrest as part of the hiring process.The Company will not discharge or in any other manner discriminate against employees or applicants because they have inquired about, discussed, or disclosed their own pay or the pay of another employee or applicant. Additionally, employees who have access to the compensation information of other employees or applicants as a part of their essential job functions cannot disclose the pay of other employees or applicants to individuals who do not otherwise have access to compensation information, unless the disclosure is (a) in response to a formal complaint or charge, (b) in furtherance of an investigation, proceeding, hearing, or action, including an investigation conducted by the employer, or (c) consistent with the Company's legal duty to furnish information.