Security Engineer III, Exploitation Analyst / Incident Responder (TS Clearance)

Deloitte seeks a Security Engineer III, Exploitation Analyst / Incident Responder to join the Cyber Defense & Resilience team in Baltimore, MD onsite.

Responsibilities

• Monitor networks, systems, and applications for indicators of compromise and analyze threat data to identify malicious activity.
• Investigate security incidents, collect and analyze logs, memory artifacts, network traffic, and support containment, eradication, and recovery activities.
• Identify and assess vulnerabilities in systems, networks, and applications and recommend remediation actions based on risk and exploitability.
• Analyze malware, exploits, and adversary tools, including reverse engineering malicious code and simulating adversary techniques in controlled environments.
• Prepare technical reports, briefings, and documentation that summarize findings, methodologies, and recommendations for stakeholders.

Requirements

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related technical field
• Active Top-Secret Clearance with SCI eligibility
• 2+ years of experience within cyber exploitation analysis, threat intelligence, or incident response
• 2+ years of experience with analyzing advanced persistent threats (APTs), malware, exploitation techniques, and reverse engineering tools such as IDA Pro or Ghidra
• 2+ years of experience performing vulnerability assessments, penetration testing, or red team activities
• 2+ years of experience with network traffic analysis, log analysis, digital forensics, Windows, Linux, macOS, common network protocols, scripting languages such as Python, PowerShell, or Bash, and security monitoring tools such as SIEM, IDS, IPS, or EDR
• Ability to travel up to 20%, on average, based on the work you do and the clients and industries/sectors you serve
• Willingness to work at client onsite or Deloitte office for up to 5 days a week
• Industry certifications such as GIAC, CISSP or CompTIA Security+ is required
• Must be legally authorized to work in the United States without the need for employer sponsorship, now or at any time in the future

Technologies

• IDA Pro, Ghidra, Python, PowerShell, Bash, SIEM, IDS, IPS, EDR, Windows, Linux, macOS, MITRE ATT&CK

The Team

Our Deloitte Cyber Defense & Resilience offering assists clients in defending against advanced threats by transforming security operations, monitoring technology, data analytics, and threat intelligence. Helps manage and protect dynamic attack surfaces and provides rapid crisis and cyber incident response, ensuring clients can be ready for, respond to, and recover from business disruptions.