Security Operations Analyst

Overview

The Security Operations Analyst role within the Cyber Security & Risk Management team is responsible for aspects of threat intelligence, monitoring, application/endpoint/network security, and insider threat. The candidate must have a curious investigative mind, an interest in information security, and the ability to communicate complex ideas to varied audiences. The Senior Analyst is a key member of the Cyber Security team responsible for participating in incident response and monitoring functions.

 

The focus of the Senior Analyst is to detect, disrupt, and eradicate threat actors from the enterprise network. The Security Operations Analyst manages day-to-day information security operations monitoring of mission critical systems, including identification, analysis, case management, and response actions. The Analyst will also be required to carry out other Cyber Security-related activities and projects as specified by management. The role involves close integration with various technical and non-technical stakeholders to drive widespread cyber security program deployment and adoption. The position will drive execution and enhancement of cyber security capabilities throughout information systems in both on-premise and cloud hosted environments. This fast-paced multi-faceted environment requires a highly-motivated, self-driven, strong team player who demonstrates an intrinsic desire for continuous personal and professional growth. Reporting to the Security Operations Manager, the Security Operations Analyst will work closely with Information Technology, Cyber Security, Audit, PMO, and LOB stakeholders, executing requirements, modifying procedures or processes, and/or managing tasks to implement security controls.

 

Principal Duties & Responsibilities: 

• Monitor the cyber threat environment and provide Tiers 1 and 2 support for day-to-day cyber security incidents and service requests.
• Analyze and report security events through SIEM, IT service management portal(s), and other security tools.
• Actively collaborate with MSSP SOC on 24/7/265 monitoring and response of cyber security incidents.
• Performs analysis, testing, documentation and modification of computer systems and/or programs based off verified threats and exploitation of malicious software.
• Conduct incident management of malware threats, phishing submissions, compromised assets, and other anomalous events.
• Liaise with the Cyber Security Engineering/Architecture and IT teams to prioritize platform requirements ensuring high quality and tuning of cyber security solutions.
• Evaluation threat capability gaps within the security stack and make recommendation to management.
• Identify and analyze threat and brand intelligence functions, composing security alert notifications and other communications.
• Identify trends and tactics in the threatscape across the production and corporate infrastructure.
• Monitor brand intelligence functions, monitoring forums, social media, and other threat actor activity channels for potential threats.
• Actively stay up to date with the latest threatscape, attack vectors and countermeasures (engage with ISACs).
• Identify, communicate, and coordinate risk management activities such as vulnerability scanning, dynamic scans, confidentiality, and privacy review etc.
• Collect and maintain evidence supporting cyber assessment findings and recommendations.
• Translate infrastructure technologies such as Network, Database, Server, Endpoint, etc. issues into cyber risks for threat monitoring.
• Conduct Vulnerability Management functions, ensuring vulnerability remediation tasks are properly executed (validation of findings, execution/coordination of remediation, and validation/evidence of remediation).
• Prepare system security reports by collecting, analyzing, and summarizing data and trends.
• Track and communicate assessment required activities and status to stakeholders.
• Implement processes or controls in support of control framework, audit, and risk requirements.
• Continuously update job knowledge by tracking and understanding emerging security practices and standards; participating in educational opportunities; reading professional publications; maintaining personal networks; participating in professional organizations.
• Collaborate with management to determine information security metrics and helps with the collection of information security metrics.
• Collect security incident metrics & data to enable reporting to senior management.
• Upgrade security systems by monitoring security environment; identifying security gaps; evaluating and implementing enhancements.
• Support skill set development of the team members (mentoring, cross-training).
• Develop an understanding of business