Security Analyst, Dfir - R12194

ABOUT OPORTUN

Oportun (Nasdaq: OPRT) is a mission-driven fintech that puts its 2.0 million members' financial goals within reach. With intelligent borrowing, savings, and budgeting capabilities, Oportun empowers members with the confidence to build a better financial future. Since inception, Oportun has provided more than $16.6 billion in responsible and affordable credit, saved its members more than $2.4 billion in interest and fees, and helped its members save an average of more than $1,800 annually. Oportun has been certified as a Community Development Financial Institution (CDFI) since 2009. WORKING AT OPORTUN
Working at Oportun means enjoying a differentiated experience of being part of a team that fosters a diverse, equitable and inclusive culture where we all feel a sense of belonging and are encouraged to share our perspectives. This inclusive culture is directly connected to our organization's performance and ability to fulfill our mission of delivering affordable credit to those left out of the financial mainstream. We celebrate and nurture our inclusive culture through our employee resource groups. The ideal candidate will provide technical support of a 24x7 cyber program in the areas of incident  response,  insider  threat  investigations, forensics, cyber threats and information security. Corporate duties such as solution/proposal development, corporate culture development, mentoring employees, supporting recruiting efforts, will also be required.  The program is currently operating remotely RESPONSIBILITIES Execute documented processes within all activities of the CIRT playbook and security incident response lifecycle. Collect, preserve and process volatile information and evidences needed to conduct highly-confidential forensic investigations. Investigation of digital evidences may include: Storage media (i.e. hard drives, optical and flash media) Electronic data (i.e. electronic files, pictures, web data, technology device logs) Mobile devices (i.e. mobile phones, tablets) Volatile media (i.e. workstation memory) Preserve the admissibility of collected evidences and Chain of Custody, in accordance with team and industry best practices. Ensure forensic evidences, and corresponding documentation, are identified, recorded, secured and accurately tracked. Investigate low to medium complexity incidents cases assigned such as, but not limited to: Acceptable Use Policy / Code of Business Ethics Violation Malware Fraud, Intellectual Property Theft, Industrial Espionage Cyber Attack / Hacking / APT / Security Breaches Investigation of digital evidences may include: Storage media (i.e. hard drives, optical and flash media) Electronic data (i.e. electronic files, pictures, web data, technology device logs) Follow forensic investigation and incident response procedures, processes, policies, guidelines. Examine and analyze security events or incidents, and investigate low to medium complexity issues, related to technology infrastructure. Employ technical, investigative and analytical skills to solve assigned issues or problems. Carry out or coordinate containment and remediation steps, until security incident closure, as advised by Incident Response Specialist or Manager. Produce detailed written reports outlining the circumstances around the incident, present forensic evidences and communicate investigation results and relevant findings to a non-technical audience Provide mentorship and guidance to junior team members REQUIREMENTS Bachelor's Degree in Information Technology, Cyber Security, Computer Science, Computer Engineering OR 5-8 years of relevant experience in Incident response or Cyber Forensics. Experience in decoding logs from different security devices like Firewall, proxy, EDR etc., Experience in handling cyber incidents on a day to day basis. In depth experience with Windows, Linux, and MacOS Experience in using one or more of the following: Magnet Axiom, AccessData FTK, Encase, X-Ways, The Sleuth Kit/Autopsy, Volatility Experience automating workflows with one of the following PowerShell, Bash, Python Familiarity with the TCP/IP suite of protocols Experience conducting forensic investigations based on EDR, XDR, memory, disk, and log-based evidence Experience conducting static and dynamic malware reverse engineering In depth knowledge of Cloud, Web Application and API security, including conducting forensic investigations on their technology stacks Familiarity with Windows and Unix process and memory structures Knowledge, Skills, and Abilities Ability to communicate efficiently with internal team members at all levels and across functional and organizational boundaries. Working knowledge of the TCP/IP suite/OSI layers of protocols. Conceptual knowledge of network and systems architecture. Familiarity with Intrusion Detection Systems configuration and operation. Web application architecture. Active Directory Solid understanding of how major application layer protocols function (e.g., HTTP, SMTP, DNS). Knowledge of categories of malware and how they function (e.g., rootkits, trojans, adware, exploits, fileless). Organizational skills and time management/prioritization. Comfortable working against deadlines in a fast-paced environment. Ability to build a strong, positive relationship with partnering engineering and security teams to develop effective solutions. Ability to sufficiently document engineering efforts and results. Passion for Security, Technology and Automation. Attention to detail and excellent documentation skills Ability to explain technical details to business leadership with a focus on encouraging technical changes or investment where appropriate Good to Have: One or more computer forensics and information security certifications is a plus : Guidance Software Encase Certified Examiner (EnCE) EC Council Computer Hacking Forensic Investigator (CHFI) EC Council Certified Ethical Hacker (CEH) SANS GIAC Certified Incident Handler (GCIH) SANS GIAC Certified Forensic Examiner (GCFA) ISC2 Certified Information Systems Security Professional (CISSP) ISACA Certified Information Systems Auditor (CISA) ISACA Certified Information Systems Manager (CISM) Comptia Security + Reverse malware, advanced security operations, advanced tech support, digital forensic investigator 3 years vulnerability assessment and penetration testing #LI-REMOTE #LI-GK1 We are proud to be an Equal Opportunity Employer and consider all qualified applicants for employment opportunities without regard to race, age, color, religion, gender, national origin, disability, sexual orientation, veteran status or any other category protected by the laws or regulations in the locations where we operate. California applicants can find a copy of Oportun's CCPA Notice here:  https://oportun.com/privacy/california-privacy-notice/. We will never request personal identifiable information (bank, credit card, etc.) before you are hired. We do not charge you for pre-employment fees such as background checks, training, or equipment. If you think you have been a victim of fraud by someone posing as us, please report your experience to the FBI's Internet Crime Complaint Center (IC3).