Tactical Threat Operations Developer
You’ll be joining the Cyber Threat Operations team at PwC with responsibility for the rapid prototyping, development and oversight of a range of technology solutions which underpin our threat intelligence, hunting, incident response and red teaming groups, and the services they provide to our global client base.
Our Cyber Threat Operations practice is PwC’s front-line technical services group, responsible for the development, management and execution of a portfolio of blue and red team services to our global clients. We provide subscription and bespoke threat research services, short-term and managed endpoint and network hunting services, incident response and readiness services and adversary emulation.
As part of the role, you’ll be working across these teams while they identify and investigate intrusions, evolve collection strategies, implement new red-team TTPs and much more. You will get the first shot at coming up with innovative techniques to solve a wide range of needs – from urgent scripts needed on an incident response case, to longer term development and maintenance of our threat intelligence platforms, to methods to automate the creation of online personas and associated infrastructure to be used in red team engagements.
We’re looking for passionate, creative individuals who live and breathe the following topic areas:
- Developing tools, scripts and systems to streamline or automate common blue and red team requirements, including intelligence automation processes, collection methods and analytical capability;
- Integrating disparate systems and data sources into analytical platforms, or orchestrating actions via APIs across multiple systems; and,
- Production of techniques to streamline the development of analytic content, detection concepts and signatures to detect malicious activity in log data, network traffic or on endpoints.
- Owning the coordination and implementation of technical development requirements from red and blue teams (e.g. working with a reverse engineer to implement a configuration decoder for a malware family, integrating a new data source to a TI platform, automating the provision of VMs and domains etc. for an adversary simulation engagement).
- Ownership of the end-to-end integration for our threat intelligence stack (ad-hoc collection scripts, malware sandboxes, Yara/OpenIOC distribution, sinkholes etc.);
- Any UI/UX experience would also be a huge plus.
- Maintaining a general understanding of open source and commercial red and blue team tooling.
- Eagerness to get stuck in and help out with analysis on threat intel and incident response engagements in order to inform future technology requirements;
Qualifications & Experience:
- Experience of analytical tools and capabilities used in a Cyber Intelligence functions such as Maltego or MISP.
- Understanding of open source and commercial information sources such as VirusTotal, Hybrid Analysis and OTX.
- Deep understanding of the Cyber Kill Chain and the Diamond model and how they apply to threat intelligence.
- Basic knowledge of security network architectures (e.g. Firewalls, DMZ, proxies, DNS, web and mail servers) and the principles of network security.
- Experience of malware analysis and being able to interpret their findings as well as from vendor reporting.
- Ability to normalise and analyse large datasets, often in unstructured formats.
Assurance is a dynamic place to be right now, and the variety of opportunities on offer is unprecedented. It’s work that really does matter. It matters for businesses, governments and society at large. Our team provides confidence on the most complex decisions companies have to take and this provides a wealth of opportunities to everyone who joins us and works with us.
The skills we look for in future employees
All our people need to demonstrate the skills and behaviours that support us in delivering our business strategy. This is important to the work we do for our business, and our clients. These skills and behaviours make up our global leadership framework, ‘The PwC Professional’ and are made up of five core attributes; whole leadership, technical capabilities, business acumen, global acumen and relationships.
Learn more here www.pwc.com/uk/careers/experienced/apply
We work in a changing world which offers great opportunities for people with diverse backgrounds and experiences. We seek to attract and employ the best people from the widest talent pool, as well as those who reflect the diverse nature of our society. And we aim to encourage a culture where people can be themselves and be valued for their strengths. Creating value through diversity is what makes us strong as a business and as an organisation with an increasingly agile workforce, we're open to flexible working arrangements where appropriate.
Learn more here www.pwc.com/uk/diversity