Cybersecurity Operations Center Analyst

Who Are We?

Taking care of our customers, our communities and each other. That’s the Travelers Promise. By honoring this commitment, we have maintained our reputation as one of the best property casualty insurers in the industry for over 160 years. Join us to discover a culture that is rooted in innovation and thrives on collaboration. Imagine loving what you do and where you do it.

Job Category

Technology

Compensation Overview

The annual base salary range provided for this position is a nationwide market range and represents a broad range of salaries for this role across the country. The actual salary for this position will be determined by a number of factors, including the scope, complexity and location of the role; the skills, education, training, credentials and experience of the candidate; and other conditions of employment. As part of our comprehensive compensation and benefits program, employees are also eligible for performance-based cash incentive awards.

Salary Range

$74,400.00 - $122,800.00

Target Openings

1

What Is the Opportunity?

The Cybersecurity Operations Center Analyst is responsible for monitoring enterprise systems and performing incident responder in our 24x7x365 Security Operations Center (SOC). This is a shift-based, on-call position that works with a skilled cybersecurity team to help protect enterprise resources. Responsibilities will include, but not be limited to, performing cybersecurity analysis, monitoring, and incident response. You will need to provide coverage from 12:00 p.m. - 8:00 p.m. EST hours.

The ideal candidate will bring a background/experience in a hands-on Cybersecurity role, be a good communicator, have an aptitude for learning, finding a root cause, and can critically think through problems. Self-motivation and a desire to learn are key characteristics that will lead to success in this role.

This role works with experienced cybersecurity leads and use modern technology to detect, analyze, and respond to alerts and cybersecurity events. You must be willing to work in a 24x7x365 team environment and be on-call during certain times, meaning you will be prepared to work evening and late-night schedules as required to perform incident response actions. Functionally, this means eyes-on-glass monitoring, researching, classifying, and analyzing security events that occur on across the cloud and on-premises environment. You will assess security events and follow procedures for overseeing these events, ranging from initial triage, investigation, and if needed, response. You will also periodically participate in broader projects, including investigations, automation development, data analysis, and process improvement.

To provide effective coverage of alert seasonality, this is a remote role to support the SOC’s shift 12pm – 8:30pm Eastern Standard Time.

What Will You Do?

• Work in a 24x7x365 environment, have a team-centric focus, and be prepared to work evening and late-night schedules as required to perform sufficient incident response actions.
• Able and willing to work off-hours for incident triage and response, on a rotational schedule.
• Monitor environment and perform incident response via SIEM and SOAR platforms.
• Maintains records of security monitoring and incident response activities, utilizing case management and ticketing technologies.
• Evaluates and deconstructs phishing pages and malware (e.g., obfuscated code) through open-source and vendor provided tools.
• Provide operational support, troubleshooting and maintenance of cybersecurity related processes, controls, or products.
• Support reviewing or identifying security events and escalating to management.
• Prepares briefings and simple reports of analysis methodology and results.
• Creates and maintains standard operating procedures (SOPs) and other documentation including operating instructions and knowledge transfer articles.
• Creates, debugs, modifies, and updates Security Information Event Management (SIEM) rules and SOAR automation playbooks.
• Consolidates and performs comprehensive analysis of threat data obtained from external, proprietary, and open-source resources to provide indication and warnings of potential threats or threat vectors.
• Generates end-of-shift reports for documentation and knowledge transfer to subsequent analysts on duty.
• Function as a security representative at design and technology design and configuration meetings.
• May provide guidance to more junior employees.
• Perform other duties as assigned.

What Will Our Ideal Candidate Have?

• Bachelor’s Degree in a STEM (Science, Technology, Engineering, Math) discipline preferred.
• Three years of relevant experience