Malware Remediation Engineer

Malware Remediation Engineer

Job Description

Description:

To perform the following on a daily basis:

1. Review alerts, reports, messages in the quarantine mailbox, customer requests, and other sources for evidence of messages that were misclassified. This step applies human intelligence to augment automated filtering decisions. This step sometimes involves the use of various client or public domain resources to augment the contractor’s knowledge. Message content, links, attachments, and headers may need to be reviewed.
2. Manually use TRAP to pull emails that are strongly suspected of being malicious, or to put back emails that are most likely not malicious.
3. Manually use POD to research and report incorrectly classified messages and release them as needed.
4. Manually use O365 tools to put back emails that are most likely not malicious.
5. Report false positives and false negatives to email hygiene vendor via ticketing system, to the client as needed, and to client staff as needed.
6. Maintain records of actions taken.
7. Interact with vendors, customers across the client and IT staff as necessary through various communications channels (email, telephone, instant message, SMS/text, etc.) and update client and vendor tickets as needed.
8. Perform incident and error log management in relevant applications.
9. Provide recommendations in written emails for HIR to consider minimizing false negatives and false positives in all of its filtering components or otherwise optimize its mail filtering system and operations.
10. Report on status daily in status meetings and weekly in written emails, including:

a. Hours burned and hours remaining on the contract
b. Number of messages pulled
c. Number of messages put back
d. Vendor cases opened and resolved
e. Other activities done and in progress
f. Issues encountered and current status of issues
g. Recommendations made and related status
h. Anticipated risks and mitigation strategies.

11. Assist with migration of TRAP to CTR as needed, to include testing/validation and problem reporting.
12. Other goals may arise during the engagement, with agreement by the offeror and the POC.
13. Hands-on access to client systems will be required.
14. The client equipment will be provided.
15. Contractor must comply with all relevant client policies and procedures.

Candidate Capability Requirements/Experience:
The offeror’s response should identify how the candidate meets the below requirements.
2. The Contractor shall have a minimum of 3 years (5 years preferred) experience with enterprise email management.
3. The Offeror will provide a maximum of 3 resumes of proposed staff demonstrating proven experience and ability with the following within the last year in an enterprise environment:

Understanding of email terminology and technology (including authentication, Message Transfer Agents, protocols, routing, filtering and security)

Understanding of email-based threats to include phishing techniques, attachment-based malware, and URL-based malware including ransomware, initial access brokers, remote access trojans, stealers, etc.

Performing technical review of email messages for security implications, to include message content, links, attachments, and headers

Familiarity with modern email filtering systems such as Proofpoint (specific Proofpoint experience not required)

Using tools to pull malicious messages out of mailboxes and put back non-malicious messages
o O365 security and compliance admin tools or similar
o Proofpoint TRAP, CTR, or similar
o Other methods acceptable

Using log reporting tools such as Splunk, Proofpoint PPS/POD SmartSearch, or similar
Interacting with vendors, customers and staff relating to email filtering operations and providing effective communication, both orally and in writing with these stakeholders

4. The selected candidate should require minimal oversight.





Notes:
One consultant will serve full-time (40 hours per week for 52 weeks)

VIVA is an equal opportunity employer. All qualified applicants have an equal opportunity for placement, and all employees have an equal opportunity to develop on the job. This means that VIVA will not discriminate against any employee or qualified applicant on the basis of race, color, religion, sex, sexual orientation, gender identity, national origin, disability or protected veteran status