Senior Analyst, Cyber Security Operations

Company Description

Work with Us. Change the World.

At AECOM, we're delivering a better world. Whether improving your commute, keeping the lights on, providing access to clean water, or transforming skylines, our work helps people and communities thrive. We are the world's trusted infrastructure consulting firm, partnering with clients to solve the world’s most complex challenges and build legacies for future generations.

There has never been a better time to be at AECOM. With accelerating infrastructure investment worldwide, our services are in great demand. We invite you to bring your bold ideas and big dreams and become part of a global team of nearly 50,000 planners, designers, engineers, scientists, digital innovators, program and construction managers and other professionals delivering projects that create a positive and tangible impact around the world.

We're one global team driven by our common purpose to deliver a better world. Join us.

Job Description

AECOM is seeking a Senior Cyber Security Analyst for our Global Cyber Security Operations Centre (CSOC). This will be a remote/virtual position that can be based from a variety of locations in Canada and the United States with specific requirements to cover North America time zone hours.

This role will be an integral part of a high performing team providing triage and response services as part of a "follow the sun" model. He/she will be responsible for partnering with members of IT in various global regions for incident containment and remediation.

Periodically the analyst will also be expected to liaise with the organization's IT and security leadership in support of security OR business project(s) with security implications. These projects typically target expansion or improvements to CSOC capabilities or new AECOM business development.

The ideal candidate for this role is a seasoned professional with a broad level of experience in multiple areas of IT and a strong emphasis on Cyber Security. This includes awareness of current security risks, threats and targeted attack methods, techniques and tactics. In addition, we are seeking someone who has experience with technical investigations using contemporary event correlation and endpoint investigation technology. Finally, the candidate should possess strong analytical skills and have an inherent passion for seeking knowledge, sharing knowledge and continuous process improvement.

MAJOR TASKS AND RESPONSIBILITIES MAY INCLUDE:

• Monitor and analyze alerts from various sources in the incident queue.
• Identify false positive alerts and suggest appropriate tuning to stop any reoccurrence.
• Accept responsibility for ongoing incidents handed off from the previous shift.
• Communicate status of new and ongoing incidents that are handed off to the following shift.
• Manage and maintain playbooks and runbooks, both manual and automated; make recommendations for improvements.
• Analyze phishing emails submitted for review. Research and document malicious emails and provide data for clean-up and email purge to the appropriate email teams.
• Identify and analyze systems exhibiting suspicious or malicious behavior.
• Collect and analyze volatile forensic data to confirm or rule out malicious or attacker activity.
• Perform threat & malware analysis and research.
• Follow up and determine root cause of incidents.
• Produce written reports to management after large scale incidents.
• Provide recommendations post-incident to mitigate failed security controls.
• Mentoring and knowledge sharing with local and global CSOC team members.

Qualifications

Minimum Requirements:

• Bachelor degree in Cyber Security, Computer Science, or similar, and at least 6 years of relevant IT / IS experience, or demonstrated equivalency of experience and/or education.
• Must be able to work one on-call weekend approximately every 6-8 weeks.
• Solid understanding of the Windows operating system, registry, security configurations, services, processes, etc.
• English oral/written communication skills.
• Ability to pass a background check.
• Able to work well on a virtual team without close Supervision.
• Ability to cover North America time zone hours

Preferred Qualifications:

• Experience working with a global company and team.
• Current security industry certifications preferred (GIAC, SC2, EC-CounciI, etc).
• Strong analytical and problem-solving skills,
• Strong interpersonal and customer service skills.
• Experience with built-in OS shell commands and 3rd party command line tools.
• Familiar with general IT security best practices and controls.
• Familiarity With Linux/Unix systems.
• Strong familiarity wit