Threat Detection Specialist

At FNZ, our purpose is to make wealth management more accessible, bringing easier, fairer and more inclusive solutions to people worldwide. Here in the Global Cyber & Information Security team, we are on a mission to embed cyber resilience across FNZ, protecting the platforms that support investment solutions for over 20 million people. 

We are looking for a Technical Threat Intelligence and Detection Specialist to work in support of the Cyber Resilience and Operations area of FNZ.

This is an exciting opportunity to bolster FNZ’s security defences by researching, writing, and implementing new cybersecurity use cases and detection rules. The role would be well suited to a security engineer looking to gain more experience of hands-on operations or a threat intelligence specialist hoping to focus on technical detection writing. The successful candidate will report into the Global Threat Intelligence Manager and gain exposure to a wide range of cybersecurity operations at FNZ across threat intelligence, incident response, vulnerability management, and security engineering. You will learn more about financial-services teams’ operations in a close-knit and friendly environment. 

You will have existing exposure to security monitoring in a corporate environment. Hands-on experience of SIEM technologies is vital to this role, while past experience of threat actor tracking would be of benefit. 

Role Responsibilities:

• Write new detection rules and use cases to identify suspicious activity for further investigation based on the latest threat actor activity 

• Use a detection-as-code pipeline to deploy detection rules into the existing security monitoring environment 

• Work closely with Security Operations Analysts in reducing the volume of false positives. Tune existing rules to make efficiency gains 

• Collaborate with Threat Intelligence Specialists on identifying and solving gaps in current security monitoring coverage. Create new use cases based on identified activity in the wild 

• Map rules to the MITRE ATT&CK framework as the underlying threat model 

• Maintain metrics highlighting current gaps and efforts to improve monitoring 

• Maintain a good understanding of current threat actors’ tactics, techniques, and procedures (TTPs) 

• Liaise with the Threat Hunting function to mature the company’s detection capabilities 

• Participate in the updating of the FNZ threat scenario library 

​

Experience required:

• Hands on experience of threat detection and security monitoring technologies including SIEM and EDR solutions 

• Knowledge of use case generation processes in the SIEM – experience with well-known SIEM technologies is highly beneficial (e.g. Splunk, Microsoft Sentinel, LogRhythm)  

• Good understanding of the current cyber threat landscape for firms operating in the financial services and wealth management sector 

• Hands on experience of using the MITRE ATT&CK