At Allstate, great things happen when our people work together to protect families and their belongings from life's uncertainties. And for more than 90 years our innovative drive has kept us a step ahead of our customers' evolving needs. From advocating for seat belts, air bags and graduated driving laws, to being an industry leader in pricing sophistication, telematics, and, more recently, device and identity protection.

Job Description
We are seeking an experienced Threat Hunter to perform intelligence-driven network defense supporting the monitoring and incident response capabilities. The role will involve analysis of large amounts of data from vendors and internal sources, including various indicator feeds, Splunk, and several threat intelligence tools, etc. The candidate will perform the functions of threat operations and hunting and serve as a liaison for Threat Intelligence for the Cyber Security Operations Center, and mentor the incident handling, incident response, and forensics teams.

• Performs research and analysis of potential and known threats and vulnerabilities for assigned areas and cybersecurity operational systems; designs, executes, and records results of testing plans and scripts and suggests improvements
• Deep understanding of common network and application stack protocols, including but not limited to TCP/IP, SMTP, DNS, TLS, XML, HTTP, etc.
• Advanced experience with security operations tools, including but not limited to:
  • SIEM (e.g. Defender, Splunk, ArcSight)
  • EDR (e.g. CrowdStrike, Tanium)
  • Indicator management (e.g. ThreatConnect)
  • Signature development/management (e.g. Snort rules, Yara rules)
• Broad experience with various common security infrastructure tools (NIDS, HIPS, EDR, etc.)
• Excellent analytical and problem solving skills, a passion for research and puzzle-solving.
• Expert understanding of large, complex corporate network environments.
• Strong communication (oral, written, presentation), interpersonal and consultative skills, especially in regard to white papers, briefs, and presentations.
• Good organization and documentation skills
• Leadership and mentorship skills
• Evaluates business processes and cybersecurity systems to develop incident response plans for assigned area; executes plan to detect, alert, and contain intrusions and attacks, ensure required actions are taking place, and communicate status to affected areas and leadership
• Provides leadership and mentoring for less experienced team members on assigned projects and in area of specialized expertise