The Threat Analyst will take input from many sources and validate if those threats are something Falcon can mount an effective defense against
The analysis can range from simple execution and review of the behaviors to reverse engineering
As Falcon is first a behavior based system, understanding how the threat is working and what it is doing to interact with the host environment can be important
The Threat Analyst will be expected to use the appropriate technique to efficiently understand the threat to identify how to best mitigate it
The Threat Analyst will work with other stakeholders and create automations for processing large numbers of samples
The analyst needs to have a good understanding of various file formats and familiarity with unpacking of common packers
Additionally, this role will be looked on as the go to person when the team needs to quickly process a large amount of samples with custom parsers or create custom file type specific processing workflows
Leaning on a proven track record of threat analysis, the successful candidate will be comfortable working to focus on the appropriate threats and identifying automation opportunities
As the gateway to the response organization for many new threats, good cross team collaboration skills are important
Clear, effective communication of technical details in a means which is actionable is the key to success
Another aspect of the position is to define and automate processes to reduce time and manual effort in the analysis of threats
Like communicating the threat details, prioritizing automation tasks and features will help define success of the role
The analyst needs to understand the bigger picture of threat analysis and work with stakeholders to reduce manual steps
The team will look to the successful candidate to help define and prioritize the roadmap for analysis automation and implementation
These are the tools and systems which will ultimately automate manual data collection so more time can be spent on understanding the threat
What you'll Need:
Bachelors or Masters in Computer Science or comparable field.
10+ year s experience in the threat research field with a focus on malware analysis and research automations.
Knowledge of various executable file formats and ability to create parsers is a must.
Experience in one or more high level programming languages (Python, Go, Rust, etc) is preferred
Experience in working with relational and non-relational/NoSQL databases technologies like MySQL, Cassandra, ElasticSearch is a plus.
Some experience with building scalable sample processing solutions.
A reasonable level of proficiency in static and behavioral analysis of Malware.
A working knowledge of Malware Sandboxing technology, AMSI, ETW and API hooking work is a plus.
Benefits of Working at CrowdStrike:
Remote-first culture
Market leader in compensation and equity awards with option to participate in ESPP in eligible countries
Competitive vacation and flexible working arrangements
Physical and mental we'llness programs
Paid parental leave, including adoption
A variety of professional development and mentorship opportunities
Access to CrowdStrike University, LinkedIn Learning and Jhanna
Offices with stocked kitchens when you need to fuel innovation and collaboration
Birthday time-off in your local country
Work with people who are passionate in our mission and Great Place to Work certified across the globe