Senior Cyber Security Analyst

Senior Cyber Security Analyst

Your responsibilities will include but are not limited to being an escalation point and expert on cyber incidents of various types, threat hunting for TTPs prioritized by internal and external threat intelligence, owning team process improvements as well as mentorship, and staying on top of industry technology and cyber threat advancements. We are a passionate global team dedicated to helping keep our clients and our firm safe.

RESPONSIBILITIES

• Maintain a core competency in event analysis and serve as an escalation point for noteworthy investigations, deeper investigations, and those that require critical attention.
• Continue to build out new capabilities within the program aligned with our attack surface. Opportunities include detection enhancements, improved or new standard operating procedures, and working with internal teams to tune and operationalize new technologies.
• Focus on continuing to develop dashboards, direct alerting, risk-based alerting, reports, and other objects as needed in Splunk.
• Continue to maintain a depth of knowledge within the cyber security field. This entails following threat actor activity targeting the industry and speaking knowledgeably at regular internal threat intelligence briefings.
• Leveraging threat intelligence, experience, and other inputs to perform active threat hunting.
• Work alongside the Attack Surface Management Team to build response playbooks on emerging vulnerabilities.
• Interface with technical and non-technical users to conduct fact-finding interviews, gather forensic artifacts and understand business processes.
• Engage with other teams as appropriate, either as a result of incident response, to build platform specific alerting, or to advocate for improvements to configurations or technologies.
• Continue to develop and improve the Cyber Incident Response Plan and advocate for the program.
• Participate in on-call rotation for escalated security events.

QUALIFICATIONS

• Experience in having worked in a Security Operations, CSIRT, or similar role and able to demonstrate a passion in Cyber Security.
• Experience building out functions of a Cyber Defense Team such as an insider risk, threat intelligence, breach attack simulation, or similar programs.
• Strong understanding of the fundamentals such as packet, file, and log analysis.
• Knowledgeable with various security infrastructure tools such as firewalls, intrusion prevention/detection systems, proxy servers, email controls, anonymizing technology, data loss prevention, Endpoint Detection and Response (EDR), and SIEM (Splunk)
• Strong understanding of common communication protocols, networking fundamentals and the necessary tools to analyse network activity.
• Track record of mentorship and knowledge sharing to broader team members.
• Preferred: Relevant recognized credentials (CISSP, CEH, GCIH, OSCP, or similar)
• Preferred: Working knowledge of Amazon AWS services and secure configurations.
• Preferred: Experience working with Microsoft cloud technologies (Azure Active Directory, Office 365, Defender 365)