5. 資安事業群 - 研發部 - 資安分析師｜InfoSec BU - R&D - Cybersecurity Analyst

## 職務說明

專注於資安事件分析、威脅偵測與事件應變，從系統、端點、網路及應用程式事件中識別異常行為，並建立可實際運作的偵測方式。

## 工作內容

• 分析資安事件、Log 與系統行為。
• 識別異常活動與可能的入侵跡象。
• 建立、驗證與調整 Detection Rule 及 Alert Logic。
• 執行事件調查、攻擊路徑分析與影響評估。
• 將攻擊行為轉化為可觀測與可驗證的偵測方式。
• 進行 Threat Hunting 與事件追蹤分析。
• 建立 Incident Response 流程、SOP 與 Playbook。
• 撰寫事件分析、偵測邏輯及相關技術文件。

## 必要條件

• 2 年以上資安監控、事件分析、事件應變或相關經驗。
• 熟悉常見攻擊手法與基本防禦概念。
• 具 Log Analysis 與基本 Network Packet Analysis 能力。
• 熟悉 Windows 或 Linux 系統。
• 能使用 Python、PowerShell 或 Shell 進行分析或自動化。
• 能獨立分析資安事件並判斷可能的攻擊行為與影響。

## 加分條件

• 具 Incident Response、Detection Engineering 或 Threat Hunting 經驗。
• 熟悉 Endpoint Security、Network Security 或資安監控相關技術。
• 熟悉 MITRE ATT&CK、Sigma、YARA、KQL 或 SPL。
• 熟悉 Windows Event Log、Sysmon、ETW 等事件來源。
• 具 Malware Analysis 或 Reverse Engineering 經驗。
• 具 Detection Rule 設計、驗證與調校經驗。

不要求同時具備所有分析與偵測能力，會依個人專長安排主要工作方向。

---

## Position Overview

Analyze security events and system telemetry to identify threats, investigate attack behavior, and develop practical detection methods.

## Responsibilities

• Analyze security events, logs, and system behavior.
• Identify anomalous activity and potential indicators of compromise.
• Develop, validate, and tune detection rules and alert logic.
• Conduct incident investigations, attack path analysis, and impact assessment.
• Translate attack behavior into observable and verifiable detection methods.
• Perform threat hunting and follow-up analysis.
• Develop incident response procedures, SOPs, and playbooks.
• Maintain incident analysis and detection documentation.

## Required Qualifications

• 2+ years of security monitoring, incident analysis, incident response, or related experience.
• Understanding of common attack techniques and defensive concepts.
• Experience with log analysis and basic network packet analysis.
• Familiarity with Windows or Linux systems.
• Ability to use Python, PowerShell, or Shell for analysis or automation.
• Ability to independently investigate security events and assess potential impact.

## Preferred Qualifications

• Experience with incident response, detection engineering, or threat hunting.
• Experience with endpoint security, network security, or security monitoring technologies.
• Familiarity with MITRE ATT&CK, Sigma, YARA, KQL, or SPL.
• Familiarity with Windows Event Logs, Sysmon, or ETW.
• Experience with malware analysis or reverse engineering.
• Experience designing and tuning detection rules.