Cyber Intelligence Instructor

About the job

As a member of the Education team, you will be responsible for aspects of both internal and external education, specifically in cyber security areas such as digital forensics and incident response. As a technical functional role, it includes training delivery, course development, and documentation support. You will work with a sense of purpose and urgency, can prioritize tasks, meet deadlines, and demonstrate keen attention to detail resulting in the delivery of high-quality work products.

You possess an extensive understanding of the intelligence lifecycle within cybersecurity operations and expert at implementing intelligence-led defense practices, illustrating how strategic threat intelligence delivers impact far beyond basic Indicator of Compromise (IOC) feeds. A comprehensive understanding of core threat intelligence frameworks such as the MITRE ATT&CK® matrix, the Cyber Kill Chain®, and the Diamond Model is required. You will demonstrate deep familiarity with the Tactics, Techniques, and Procedures (TTPs) utilized across a broad spectrum of adversary profiles, ranging from financial cybercrime syndicates to Advanced Persistent Threats (APTs).

As an integral component of Google Cloud, Mandiant stands as a trusted global leader in frontline incident response, advanced threat intelligence, and dynamic security defense. Trusted by executive leadership and security teams worldwide, Mandiant integrates exceptional breach response experience, nation-state level threat intelligence, cutting-edge automation, and comprehensive security validation to stay ahead of sophisticated modern threat actors.

Responsibilities

• Deliver and manage classroom training to a variety of technical audiences.
  
• Provide support for cyber security course development efforts, including product research, providing subject matter expertise, and training content review.
• Coach students and assess their technical capabilities, processes, and procedures as they investigate simulated attack scenarios.
• Create, update, and maintain slide decks and lab exercises for customer-facing training. Assist with updates for course descriptions, and other collateral pertaining to external education.
• Maintain strong customer service orientation with the ability to build effective relationships and work collaboratively within all levels of an organization. 

Minimum qualifications:

• Bachelor's degree in Computer Science, Information Systems, Cyber Security, a related technical field, or equivalent practical experience.
  
• 3 years of experience designing and developing learning solutions across various formats and audiences (e.g., instructor-led training, elearning, microlearning).
• Experience leading technical training in learning environments such as academia, professional workplace, conference tracks or community events (e.g., BlackHat, DEFCON, RSA, OWASP, BSides, etc.).
• Ability to travel up to 50% of the time as needed.

Preferred qualifications:

• 3 years of experience as a technical trainer/professional services consultant or in an equivalent technical position within Cyber Security.
  
• 2 years of experience delivering Instructor Led Training and Virtual Instructor Led Training LT courses in cyber security-related topics (e.g., digital forensics, intrusion detection, incident response, cyber threat intelligence) to technical audiences.
  
• Ability to quickly grasp technical concepts and clearly communicate these technical concepts in live presentations.
  
• Demonstrated exceptional public speaking and presentation skills with the ability to communicate complex ideas clearly to audiences.

• Bachelor's degree in Computer Science, Information Systems, Cyber Security, a related technical field, or equivalent practical experience.
  
• 3 years of experience designing and developing learning solutions across various formats and audiences (e.g., instructor-led training, elearning, microlearning).
• Experience leading technical training in learning environments such as academia, professional workplace, conference tracks or community events (e.g., BlackHat, DEFCON, RSA, OWASP, BSides, etc.).
• Ability to travel up to 50% of the time as needed.