Lead Cyber Threat Security Analyst

About Lumen

Lumen connects the world. We are igniting business growth by connecting people, data and applications – quickly, securely, and effortlessly. Together, we are building a culture and company from the people up – committed to teamwork, trust and transparency. People power progress.

 

We’re looking for top-tier talent and offer the flexibility you need to thrive and deliver lasting impact. Join us as we digitally connect the world and shape the future.

The Role

The Cyber Threat Lead Security Analyst role will focus on complex, advanced security event and incident monitoring, threat hunting, and deep analysis of threat information within SIEM environments, various log sources, and within security control technologies directly. The Lead Security Analyst will work directly with customers to determine and communicate relevant risk and potential impact, managed suspected or confirmed customer cyber incidents, perform advanced hunting and digital forensics investigations, and document and present relevant details and lessons learned for customer incidents. This role will also provide direction for SIEM rule changes, customer escalations and inquiries, help develop improved threat analysis process and procedures, and mentor and train junior team members to continuously evolve and improve the effectiveness and efficiency of the Managed Threat Security Services program.

The Cyber Threat Lead Security Analyst role may be expected to participate in a shift schedule, and will be expected to participate in an on-call rotation to accommodate a global 24x7x365 Managed Threat Security Services program.

The Main Responsibilities

• Perform security incident and event monitoring support, including deep dive data analysis and response
• Develop and manage customer security event analysis notifications with thoughtful analysis details, evidence, conclusions, and recommendations
• Respond and manage customer issues and questions regarding major security events, including evidence supporting risk identification and recommended risk mitigation, via trouble ticket, email, and phone
• Directly manage customer escalations and customer declared incidents
• Perform advanced threat hunting and digital forensics investigations
• Document and present findings and lessons learned for declared customer incidents
• Review threat detection rules and correlations, and make recommendations for improved fidelity
• Create SIEM correlation rules and make changes to existing rules
• Directly support, train and mentor junior and new team members

What We Look For in a Candidate

Required

• Requires Bachelor’s degree in related field plus 8 years relevant experience or equivalent combination of education and experience.
• Possess exceptional customer service skills
• Communicate effectively with managers, customers and vendors
• Maintain solid working relationships, including collaborative technical activities with peers
• Strong written and verbal communication skills 
• Strong analytical and problem-solving skills
• Attention to detail with good organizational skills
• Ability to prioritize across multiple activities with good time management skills
• Advanced knowledge and experience performing security monitoring, hunting, and analysis within SIEM platforms and security controls
• 8 or more years in a Security Operations environment performing threat hunting, incident response and digital forensics support
• Advanced knowledge and skills of at least two programming languages (python and PowerShell preferred)

 

Preferred

• 4 or more years in a Security Operations environment performing advanced threat intelligence analysis, triage, and attribution
• 4 or more years in a Security Operations environment writing and presenting threat intelligence and analysis reports and bulletins
• Security industry certifications (examples):
• GIAC
• EnCE
• CISSP