Principal Information Security Operations Engineer

About Us

Matson has been the leading ocean shipping and logistics provider throughout the Pacific since 1882. We are the supply chain lifeline for Hawaii, Alaska, Guam, and islands of the South Pacific. We also offer the top two ocean shipping services in the world’s largest trade lane - Asia to the U.S. West Coast. With our subsidiaries Matson Terminals and Matson Logistics, our business focus is exceeding customer expectations with quality, reliability, and integrity.

We strive to operate in an environmentally sustainable manner and promote land-based environmental programs in Hawaii, Guam, and Alaska. We help improve the communities in which we work and live through our community giving program that annually supports hundreds of local organizations. And we work to improve diversity, equity and inclusion in our company, communities and industry through an active social equity program.

Matson is a great place to work, and everyone who works with us becomes part of the Matson ohana or family. Join our team and help us move freight better than anyone.

Learn more at matson.com.

About the Role

We are seeking a highly skilled and experienced Principal Information Security Operations Engineer to join our dynamic and innovative security operations team. The Principal Information Security Operations Engineer will be responsible for implementing and maintaining the security monitoring and alerting tools necessary to protect our organization's systems, networks, and data from potential threats. The ideal candidate will have a good mix of hands-on technical knowledge, a strong background in security operations, incident response, security risk mitigation, and security practices. The individual should be proactive, organized, analytical, detail oriented and persistent.

Security Operations is one of the critical business support responsibilities for the Information Security team. We provide insights regarding threats the company faces and expected to quickly respond and recover from potential cyber events or incidents. It is important for this individual to understand there are cyber threat actors targeting the maritime industry and we must stay vigilant, be ready to respond in a manner that will limit the impact and allow for quick recovery.

What you’ll do:

• Manage day-to-day security operational tasks such as security event monitoring, log monitoring and security incident management, compliance monitoring, data loss prevention, and monitoring and responding to emerging threats varying from endpoint to server to public cloud.
• Lead all security-related events and incidents that come into the team's various queues (including triage, containment, and remediation when necessary). Follow standard operating procedures (SOPs) to ensure security events are triaged appropriately and in a timely manner, according to SLAs.
• Understand the various stages of the incident response lifecycle and the analytical mindset when it comes to triage and investigations, including a fundamental understanding of memory processes and memory management practices, or the willingness to learn these principles. Act as primary support contact for security incidents and provide direction to infrastructure and applications teams to initiate incident response.
• Perform root cause analysis to continuously improve prevention, detection, reaction, and remediation capabilities.
• Ensure systems, networks, and applications are monitored for security breaches, intrusions, and unusual activity.
• Investigate and respond to security events and incidents, including performing root cause analysis, identifying vulnerabilities, and implementing remediation measures.
• Respond to phishing attacks by tracking down and recalling malicious e-mails; contact users who may be impacted.
• Participate in off-hours on-call rotation, as required, and necessary.
• Liaise with internal and external parties, including Managed Security Services Provider, computer forensics specialists, and additional incident responders, to address security concerns.
• Assist in managing the organization's logging environment providing fundamental knowledge of license managers, indexers, and search heads.
• Develop SOAR playbooks to minimize security incident response time and develop advanced techniques to identify and mitigate v