Jr. Threat Operations Analyst

Internova Travel Group is a global travel services company with leading leisure and corporate travel brands. The Jr. Threat Operations Analyst supports daily security operations by administering end-user security controls, triaging security events, analyzing phishing and business email compromise, monitoring threat intelligence and brand risks, and validating vulnerabilities.

What you'll do:

• Address end user support request for information security issues and SOC escalation requests
• Day to day administration of end user facing security technologies (Mimecast, Microsoft 365 ATP, Cisco Umbrella, Cisco AMP)
• Monitor and report on security events across multiple internal platforms, performing first line triage and escalating with sufficient documentation for downstream analysis
• Support phishing and business email compromise defense, including analysis of user reported messages, tuning of ATP and Mimecast rule sets, and extraction of indicators for blocking and detection use
• Track threat activity relevant to the travel and hospitality sector using Recorded Future and other sources, including business email compromise, credential stuffing, booking and payment fraud, and supplier impersonation, and summarize the impact for Internova
• Day to day use of Recorded Future for threat intelligence and brand reputation monitoring, including alert triage, watch list and query maintenance, indicator enrichment, and routing of actionable intelligence to the appropriate owner
• Investigate brand and domain impersonation, typosquatting, exposed services, and credential exposure affecting Internova and its brands, coordinating takedown and blocking action and reporting findings to enterprise security leadership
• Supplement platform reporting with independent open source intelligence collection, structuring findings so they can be acted on rather than simply forwarded
• Validate and triage vulnerability scanner and security tooling output, separating exploitable findings from false positives and tracking remediation to closure with application and infrastructure owners
• Assist information security team members with project tasks, troubleshooting, and administration responsibilities, and recommend tooling and process enhancements to senior information security staff

What they're looking for:

• Bachelor's degree in software engineering, computer science, cybersecurity, computer information systems, a related field, or equivalent practical experience
• 0 to two years of professional experience, inclusive of internships, co-ops, or research appointments in security operations, threat analysis, penetration testing, or application security
• Ability to analyze security events and logs methodically, form a hypothesis, and reach a defensible conclusion about whether activity is malicious, suspicious, or benign
• Working knowledge of common attack techniques against web applications, APIs, identity systems, and email, including authentication, authorization, injection, and business logic flaws
• Understanding of indicators of compromise and how they are collected, enriched, and applied to detection and blocking
• Exposure to at least one major cloud platform (AWS, Azure, or GCP) and to core cloud security concepts such as identity, logging, and network segmentation
• Familiarity with industry standard encryption technologies and cybersecurity technical controls
• Excellent written and verbal communication skills, including the ability to explain technical risk to non technical stakeholders and to write findings a reader can act on
• Ability to apply organizational policies and procedures to everyday operational decisions
• Ability to travel as needed

Benefits:

• Choice of two medical plans
• Choice of two dental plans
• Vision insurance
• Flexible spending accounts (FSAs)
• Company-paid life insurance and AD&D
• Optional additional life insurance and AD&D
• Disability insurance
• Paid parental leave
• Paid time off
• 401k Plan with company match