Principal, Information Security Engineer (Blue Team - SOC&CERT)L6
2293432 2020/08/14 Security, Privacy and Technology Infrastructure
Principal, Information Security Engineer (Blue Team - CERT)
Coupang Shanghai/Beijing, China
The Coupang Blue team is ultimately responsible for providing oversight and day to day leadership for all security monitoring, incident response & management, SOC and threat intelligence. Blue team is defining and delivering a pragmatic strategy that delivers the highest levels of industrially robust security operations to Coupang, for both current and future state. Also Blue team is pro-actively and effectively delivering a world class threat intelligence, incident management processes and procedures. Also, the Blue team is expanding and transforming to Cyber Fusion Center including FDS, Red Teaming and Vulnerability management.
- Conduct data breach and security incident investigations including compromise assessment
- Assess threats and technologies effecting security vulnerabilities and recent internet threats
- Perform malware analysis and reverse engineering
- Defend systems against unauthorized access, modification and/or destruction
- Liaison with other cyber threat analysis entities
- Identify abnormalities and report violations
- Oversee and monitor routine security administration
- Apply expertise in both host and network analysis to ascertain the impact of an attack and develop threat trends and mitigation techniques and countermeasures that can prevent future attacks.
- Design and conduct security audits to ensure operational security
- Respond immediately to security incidents and provide post-incident analysis
- Provide technical advice to colleagues
- 10+ years of experience in information security with at least 5+ years in security incident response
- Host based security investigation (Windows, Linux, Network/Security appliances)
- Operating SIEM and CTI (Cyber Threat Intelligence) Solutions and developing use cases
- Knowledge and experiences of EDR (Endpoint Detection and Response) system and tools such as Carbon Black, CrowdStrike, EnCase-EDR, FTK, Volatility memory forensic, etc.
- Knowledge of application security such as Web application, Mobile app traffics, etc.
- Ability to be flexible and work during non-business hours (to support a global team in different time zones)
- Language: Korean and English
- Certified in one or more of the following: CISSP, CISA, CCNA, CISM, SANS GIAC
- Working knowledge of the intelligence lifecycle and current cyber threat landscape
- Understanding of major threats and threat actors and their relevance to the eCommerce industry
- Knowledge of Cloud service practices and principles (e.g AWS, Azure)
- Proficient in one or more computer programming languages
- Development experience in Automation and Script (Linux shell, Python, Perl, Powershell)
- Experience in developing using Log Search (ELK, Splunk), TSDB(Time series DB)
- Knowledge of DevOps and Agile practices and principles
- Knowledge of open security testing standards and projects, including OWASP and ATT&CK