Cyber Security Analyst

Cyber Security Analyst

Job Description

A Southern Company Security Analyst participates in monitoring, hunting and responding to cyber security events. He or She, provides a front-line role during cyber security incidents, identifying the extent of the threat, business impacts and advising or sometimes performing the most suitable course of action to contain, eradicate and remediate an incident. A Southern Company Security Analyst maintains a good knowledge of the threat landscape, helps enhance visibility and response capabilities by identifying new methods of detecting threats. A Southern Company Security Analyst is proactive and seeks out adversaries determined to negatively impact Southern Companies reputation, financial interest or threatens the safety of our employees and customers.

Candidates are expected to discuss and demonstrate they meet required qualifications for applicable roles.

Responsibilities

• Take action on security events presented to Analyst via SIEM, user submissions, dashboards, etc.
• Self-initiate hunting initiatives to discover potential breaches or undiscovered cyber threats
• Remain abreast of emerging threat patterns and provide recommendations to detect threats
• Assists with patching recommendations and workarounds for zero-day threats.
• Coordinate mitigation or remediations task with stakeholders or supporting teams
• Communicates with management on incident updates.
• Monitors SIEM and analyzes security events to determine appropriate actions
• Monitors emails containing links/attachments associated with potential phishing attempts to determine appropriate actions
• Identify and tune false positives associated with current security events
• Document analytical steps and findings associated with security event investigations

 

Qualifications Required for Cyber Security Analyst

• 2 years IT security experience
• Minimum 2 years of experience in performing analysis on Windows and LINUX/UNIX systems
• Minimum 2 years of experience and/or familiarity in the following areas:
  • Network/Endpoint: analysis tools
  • Scripting languages
  • Windows/Unix command line utilities
  • Reputation analysis associated with IP’s, Domains, Email Addresses
  • Ticketing Systems
• Required to submit to a background examination.
• Experience operating within a security application such as Kali, Metasploit, and etc.
• Familiar with and have worked within Cyber Security Frameworks such as:
  • NIST 800 – 61
  • Attack Life Cycle
  • SANS Security Controls
  • MITRE
• SANS Security 500 Series or other industry standard equivalent
• Experience with PCAP analysis
• Experience investigating endpoint and network security events

• Experience investigating user reported Phishing events (specifically investigating suspicious links and attachments)
• Experience analyzing security events utilizing sandbox technology
• Experience operating within a security application such as Kali, Metasploit, and etc.
• Oral and written communication skills
• Experience taking ownership of incidents from acknowledgement to resolution
• Ability to identify and mitigate security events by recommending and/or implementing defensive/preventive strategies
• Experience initiating security event investigations

 

Preferred capabilities:

• Oral and written communication skills
• Ability to take ownership of incidents from acknowledgement to resolution
• Ability to initiate security event investigations
• Ability to comprehend and articulate business impact associated with security events
• Interacting with vendors to support proof of concepts
• Proficient in Microsoft Office products: Excel, Word, Outlook and etc.
• Exposure, experience and/or knowledge of cloud technology
• Familiar with NIST 800-61 and SANS Critical Security Controls
• Ability to identify and mitigate security events by recommending and/or implementing defensive/preventive strategies

Desired certifications:

• GIAC Security Essentials (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• Security+
• Other certifications within IT Security

 

Characteristics of an Southern Company Cyber Analyst

• Self-Motivated – Cyber Analysts do not only act when security tools trigger alerts, we are suspicious by nature and can generate security events based on self-initiated task.
• Perseverance - Cyber Analysts identify resourc