Lead Consultant – FortiGuard Incident Response

We are looking for a Lead Consultant – FortiGuard Incident Response to work in a dynamic and exciting new position reporting to the Director of Operations for FortiGuard Security Consulting Services.  The analyst will work directly with members of a world class incident response and forensics team. Our team is comprised of individuals with strong knowledge in malware hunting and analysis, reverse engineering, multiple scripting languages, forensics and threat actors TTPs.  In this very hands-on customer facing role the consultant’s main objective is to lead and manage the incident response engagements and train/mentor other security consultants.  Leveraging your in-depth understanding of the threat actors’ tactics, techniques, procedures and tools as well as our flagship FortiEDR tooling you will need to quickly glean situational awareness to provide guidance to the team members as well as to the client. In addition, from time to time the candidate will help to create threat research work products such as blogs and presentations. To be successful in this role the candidate must be possess strong consulting skills, deep technical skills and able to work under tight timelines.   

Responsibilities: 

• Lead IR engagements and mentoring/training junior analysis
• Continue to focus on process improvement for the customer facing incident response services
• Conduct host-based analysis and forensic functions on Windows, Linux, and Mac OS X systems
• Review firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity
• Leverage our FortiEDR Platform to conduct investigations to rapidly detect and analyze security threats
• Preform basic reverse engineering of threat actor’s malicious tools 
• Develop complete and informative reports and presentations for both executive and technical audience 
• Availability during nights/weekends as needed for IR engagements
• Perform memory forensics and file analysis as needed
• Monitor underground forums, our FortiGuard Threat Labs, along with other open-source intelligence outlets to maintain proficiency in latest actor tactics and techniques 

Required Skills:

• Experience with of at least one scripting language: Shell, Ruby, Perl, Python, etc
• Ability to data mine using YARA, RegEx or other techniques to identify new threats
• Experienced with EnCase, FTK, X-Ways, SIFT, Splunk, Redline, Volatility, WireShark, TCPDump, and open source forensic tools a plus
• Experience with malware analysis tools such as IDA Pro, OllyDbg, Immunity Debugger 
• Hands-on experience dealing with APT campaigns, attack Tactics, Techniques and Procedures (TTPs), memory injection techniques, static and dynamic malware analysis and malware persistence mechanism
• Strong knowledge of operating system internals and endpoint security experience. 
• Able to communicate with both technical and executive personnel
• Static and dynamics malware and log analysis 
• Excellent written and verbal communication skills a must
• Analysis of Linux and MAC binary files and the understanding of MAC internals is a plus but not required.
• Highly motivated, self-driven and able to work both independently and within a team
• Able to work under pressure in time critical situations and occasional nights and weekends work
• A good understanding of Active Directory a plus

Education: 

• Bachelor’s Degree in Computer Engineering, Computer Science or related field
• Or 10+ years’ experience with incident response and or Forensics 

Fortinet (NASDAQ: FTNT) secures the largest enterprise, service provider, and government organizations around the world. Fortinet empowers its customers with intelligent, seamless protection across the expanding attack surface and the power to take on ever-increasing performance requirements of the borderless network - today and into the future. Only the Fortinet Security Fabric architecture can deliver security without compromise to address the most critical security challenges, whether in networked, application, cloud or mobile environments. Fortinet ranks number one in the most security appliances shipped worldwide and more than 500,000 customers trust Fortinet to protect their businesses.
We are committed to providing reasonable accommodations for all qualified individuals with disabilities. If you require assistance or accommodation due to a disability, please contact us at accommodations@fortinet.com.   Fortinet is an equal opportunity employer. We value diversity in our company, and all qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, age, military/veteran status or any other applicable legally protected characteristics in the location in which the candidate is applying.