GIAC including GCFA, GCFE, GREM, GNFA, GCCC, and/or GCIA.

Demonstrates thorough abilities and/or a proven record of success in the following areas:

• Applying incident handling processes including preparation, identification, containment, eradication, and recovery to protect enterprise environments;
• Analyzing the structure of common attack techniques in order to evaluate an attacker's spread through a system and network, anticipating and thwarting further attacker activity;
• Utilizing tools and evidence to determine the kind of malware used in an attack, including rootkits, backdoors, and Trojan horses, choosing appropriate defenses and response tactics for each;
• Using memory dumps and memory analysis tools to determine an attacker's activities on a machine, the malware installed, and other machines the attacker used as pivot points across the network;
• Acquiring infected machines and then detecting the artifacts and impact of exploitation through process, file, memory, and log analysis;
• Analyzing a security architecture for deficiencies;
• Recognizing and understanding common assembly-level patterns in malicious code, such as code injection, API hooking, and anti-analysis measures;
• Deriving Indicators of Compromise (IOCs) from malicious executables to strengthen incident response and threat intelligence efforts;
• Conducting in-depth forensic analysis of Windows operating systems and media exploitation focusing on Windows 7, Windows 8/8.1, Windows 10, and Windows Server 2008/2012/2016;
• Conducting in-depth forensic analysis of *Nix operating systems and media exploitation focusing on CentOS, RHEL, Solaris, AIX, HPUX, and Ubuntu/Debian;
• Identifying artifact and evidence locations to answer critical questions, including application execution, file access, data theft, external device usage, cloud services, anti-forensics, and detailed system usage;
• Hunting and responding to advanced adversaries such as nation-state actors, organized crime, and hacktivists;
• Extracting files from network packet captures and proxy cache files, allowing follow-on malware analysis, or definitive data loss determinations;
• Examining traffic using common network protocols to identify patterns of activity or specific actions that warrant further investigation;
• Detecting and hunting unknown live, dormant, and custom malware in memory across multiple Windows systems in an enterprise environment;
• Identifying and tracking malware beaconing outbound to its command and control (C2) channel via memory forensics, registry analysis, and network connections;
• Targeting advanced adversary anti-forensics techniques like hidden and time-stomped malware, along with utility-ware used to move in the network and maintain an attacker's presence;
• Using memory analysis, incident response, and threat hunting tools to detect hidden processes, malware, attacker command lines, rootkits, network connections, and more;
• Tracking user and attacker activity second-by-second on the system via in-depth timeline and super-timeline analysis; and,
• Identifying lateral movement and pivots within client enterprises, showing how attackers transition from system to system without detection.

Demonstrates thorough abilities and/or a proven record of success in the following areas:

• Network Analysis, Memory Analysis, Endpoint Analysis, Cyber Incident Lifecycle, NIST 800-61; and,
• Programming Languages such as Python, Perl, C/C++, C#, PowerShell, BASH, and Batch;

Demonstrates experience with at least two of the following tools including: X-Ways, Rekall, Volatility, EnCase, Remnux, IDA, Capture.Bat, RegShot, Radare, OllyDbg, Wireshark, Network Miner, NFdump, Tanium, CarbonBlack, CylancePROTECT, and PLASO/Log2Timeline, FireEye HX, and Crowdstrike;