Responsibilities:
- Perform day to day monitoring of cybersecurity events, including reviewing, analyzing and interpreting reports from various systems to identify anomalies, trends, or threats.
- Utilize security tools to monitor systems network, infrastructure, cloud, etc for unusual and suspicious activity across a wide range of products.
- Collaborate with Information Technology teams on a daily basis for the purpose of reviewing and providing security risk-based recommendations related to incident reporting.
- Participate in security incident responses relevant to business to closure
- Partner with system owners to ensure databases, applications and cloud storage meets security best practices
- Build governance for technologies used in the firm.
- Maintain company policy as well as the documentation of revisions policy and procedure.
- Analyzing real-time security alerts and logs from firewalls, IDS/IPS, and endpoint security to detect, identify, and investigate potential breaches.
- Threat hunting to proactively identify sophisticated threats.
- Refining SIEM rules, dashboards, and reports to reduce false positives and improve visibility.
- Working with IT teams to ensure security policies are implemented correctly.
- Providing regular reports on security incidents and metrics to management.
Qualifications
- 5-8 years of experience relevant to the role
- Bachelors in Information Security, Information Technology or related discipline
- Applicable certifications such as Secuirty+, CISCO, CISSP, etc
- Detailed technical knowledge of techniques, standards and state-of-the art capabilities for authentication and authorization, applied cryptography, security vulnerabilities and remediation
- Strong development and architecture background
- Understanding of how "on-prem" servers talk to the "Cloud" (Azure/AWS) and the security gaps that happen in between.
- Advanced query writing (e.g., SQL, PowerBI, SIEM Query Language (KQL/SPL)) to pull specific data points
- Ability to work autonomously or as part of a team, within targets and deadlines.
- ability to build visual reporting in tools like Crowdstrike, Varonis, or Microsoft Sentinel Ability to influence and educate technology and development teams
- Ability to use Jira, or ServiceNow to track multiple security initiatives at once.
- Ability to explain a complex buffer overflow to a non-technical manager and a complex business requirement to a technical engineer.
- Interest in all aspects of security research and development