What the work looks like
Our honeypots are decoy servers that get attacked around the clock. Each week you go through what they recorded: login attempts, the commands attackers type, the files they try to download. You look for what is new, like a different password list, a new malware dropper or a sudden spike from one network. You write a short note on anything that changed, and pass indicators such as IP addresses and file hashes to Longview and the defensive lessons to the GRC Analyst.
What you’ll do
- Review scans, credential attempts and payloads hitting our sensors
- Write up what changed, not what is always there
- Hand indicators to the Longview team
- Pass control-relevant observations to your team's GRC Analyst
- Spend about 20–30 minutes a day reviewing incoming reports with the rest of the team, and flag promising leads to your team lead.
What you’ll bring
- Familiarity with network traffic, logs or SOC work
- An eye for what is new versus routine
What you’ll get
- Published work with your name on it
- Hands-on time with real investigation tooling and data
- A path to running your own investigations