NDR Consultant

- We are seeking a skilled NDR Security Engineer to design, implement, and manage a Network Detection and Response (NDR) presence across customer environments. - The ideal candidate will have deep expertise in cloud networking, traffic analysis, and security operations, with a proven ability to deploy NDR solutions that enhance threat visibility and response. - This role will collaborate with security, DevOps, and network teams to ensure comprehensive monitoring and rapid incident mitigation in a dynamic, customer infrastructure. Key Responsibilities: NDR Deployment: - Architect and deploy NDR solutions (e.g., ExtraHop, Vectra AI, Darktrace) in AWS and Azure to monitor critical workloads. - Configure traffic mirroring using AWS VPC Traffic Mirroring and Azure Virtual Network TAP (vTAP) to feed network data to the NDR platform. - Implement centralized traffic aggregation across multiple VPCs/VNets using AWS Transit Gateway or Azure Virtual WAN. Cloud Integration: - Integrate NDR with AWS services (GuardDuty, Security Hub, CloudWatch) and Azure services (Defender for Cloud, Sentinel, Azure Monitor) for layered threat detection. - Pipe metadata from VPC Flow Logs and NSG Flow Logs into the NDR for enhanced context. Automation and Scalability: - Develop and maintain Infrastructure-as-Code (IaC) templates (e.g., CloudFormation, ARM, Terraform) to automate NDR deployments. - Create scripts (e.g., Python, PowerShell) and automation workflows (e.g., Lambda, Azure Functions) to dynamically adjust traffic mirroring and respond to threats. - Implement auto-scaling for NDR instances to handle variable traffic loads. Threat Detection and Response: - Analyse network traffic and behavioural patterns to identify anomalies (e.g., lateral movement, data exfiltration). - Triage NDR alerts, correlate with cloud-native findings, and recommend or automate containment actions (e.g., isolate compromised instances). - Conduct forensic analysis using captured traffic data for post-incident investigations. Optimization and Testing: - Tune NDR configurations to reduce false positives and optimize performance (e.g., filter benign traffic). - Simulate attacks (e.g., port scans, malware) to validate detection and response capabilities. - Monitor and manage costs related to traffic mirroring, storage (e.g., S3, Blob Storage), and NDR operations. Documentation and Collaboration: - Document NDR architecture, configurations, and incident response procedures. - Collaborate with SOC analysts, cloud architects, and stakeholders to align NDR with organizational security goals. - Present findings and recommendations to technical and non-technical audiences. Skills: Terraform, Azure, Aws, Python Experience: 4.00-9.00 Years