01Overview
- Keep track of APTs groups (advanced persistent threats).
- Know APT Groups motivation, their tools techniques, the malware they write, and CC (command and control center), identify their targets.
- Threat intelligence analyst must have qualified experience in cybersecurity.
- A Threat Researcher is responsible for identifying and analyzing potential threats to an organization s network and systems.
- They work to understand the tactics, techniques, and procedures (TTPs) used by threat actors to compromise systems and steal sensitive data.
- Threat Researchers are also responsible for developing and implementing strategies to detect, prevent, and mitigate these threats.
- Conducting research on emerging threats and Vulnerabilities.
- Analyzing Threat intelligence data to identify potential threats.
- Developing and implementing strategies to detect and prevent threats.
- Collaborating with other cybersecurity professionals to develop and implement security measures.
- Creating reports and presentations to communicate findings to management and other stakeholders.
- Ensure all the advisories received from regulatory and strategy partners are analyzed and processed in timely manner.
- All TI trackers are updated in near real time.
- Create reports/Dashboard for higher management.
- Collects data types and sources of information in addition to commonly collecting forms of threat data, ie, malicious IPs and domains. Information from news and social media sources. Vulnerability data such as personally identifiable information.
- Performs sorting, filtering, indexing on raw data.
- Format and structure raw data.
- Take the result of several tools, data sources and combines those data points on a per-host basis, performing, investigating, and analyzing data.
- Dissemination: Deliver the intelligence to the intended consumers at different levels: Strategic, Tactical, Operational, Technical.
- Provide Contextual Intel feeds to all the stacks which requires priority attention to protect HDFC assets.
- Regular training and knowledge sharing with the team.
- Collaboration with TH and RT and provide threat intel to SOC CD to create use case.
- There should be no audit points to come from the defined and existing process. Audit requirements should be fulfilled.
- Efficacy testing for new product as per industry best practice.
- Timely tracking and follow-ups on all open alerts/advisories.
- Timely escalation on open issues/tasks.
- Responding to all intelligence received from our Threat Intel partners and inform seniors or required escalation where required like Bank data leak/breach alerts.
- Doing in-house threat research from the open sources along with the help of our existing Threat Intel portal. .
