Cybersecurity Advisors Network (CyAN)

• mature, lead and deliver the firm’s service offerings around system-wide views of threat-driven risks and applying them to the testing of systems and services that the firm delivers. • Partner with sales and delivery teams to support pre-sales engagements, scope assessments, and solution development efforts • Mentor and develop managers, leads, and senior consultants • Influence hiring standards, interview calibration, and onboarding for senior technical roles within the practice • Define and maintain practice playbooks, severity models, and exploitation guidelines • Lead offensive security team members for Cyber Advisors, maximizing the efforts and satisfaction of all offensive security team members. • Mature the program and methodology that shapes how Cyber Advisors approaches Threat Emulation, to include defining the rules and parameters for ethical hacking of systems, software and networks to identify and mitigate potential vulnerabilities • Set direction and oversee the performance of penetration tests and Threat Emulation simulations on targets across all Cyber Advisors partners and customers • Assisting in the sales process with potential or existing clients, and acting as a client’s primary program contact for projects delivered by Cyber Advisors’ Threat Emulation team • As necessary, perform scoped and open-ended assessments on internal and external facing systems • Perform threat and vulnerability research to identify new ways of achieving the program’s mission and act as a source for innovation within the cybersecurity industry • Participate and contribute to Cyber Advisors’ social media presence on various platforms

• Lead complex DFIR investigations end-to-end: scope, evidence strategy, analysis, and findings validation across endpoint, identity, cloud, and network telemetry. • Perform advanced forensic analysis (disk, memory, cloud artifacts) including timeline construction, persistence discovery, credential access signals, and data access/exfiltration assessment. • Conduct root cause analysis to determine the TTPs (Tactics, Techniques, and Procedures) used by threat actors and propose measures to prevent similar incidents in the future. • Serve as incident lead or deputy lead for major incidents: coordinate containment/eradication/recovery with stakeholders and ensure evidence is preserved while response actions proceed. • Produce high-quality incident reports: executive summary, technical narrative, timeline, root cause, and prioritized remediation recommendations. • Own and improve DFIR playbooks, evidence collection checklists, and case documentation standards; conduct quality reviews and coaching. • Design/implement analysis automation (scripts, parsers, Velociraptor/KAPE artifacts, SOAR integrations) to reduce time-to-triage and improve consistency. • Support threat hunting and detection improvement by translating DFIR findings and Offensive Security TTPs into detection opportunities and telemetry requirements. • Mentor DFIR Analysts through case reviews, technical sessions, and training plans; help build specialization (cloud forensics, memory, network, malware triage).