Cyber Security Analyst

We are looking for a Cyber Security Analyst to be an integral part of our team, ensuring prompt and accurate responses to security incidents within our organization. Your expertise will be vital in assessing security logs, SIEM alerts, and incident reports to identify and mitigate potential risks, thereby enhancing our overall security framework.

Key Responsibilities:

Incident Response & Investigation:

• Address and investigate security incidents such as breaches, malware incidents, and phishing schemes.
• Continuously monitor networks and systems for security breaches, alerts, and unusual activities.
• Conduct root-cause analyses to avert future incidents and create detailed incident response procedures.

Security Monitoring & Analysis:

• Analyze and trend security log data obtained from various security devices.
• Configure and maintain SIEM tools to align with the organization’s security goals and threat landscape.
• Develop custom SIEM dashboards and reports for various stakeholders to visualize essential security metrics and incident information.
• Enhance and refine SIEM content, including rules, alerts, and correlation logic, for improved threat detection and response.
• Regularly review and adjust SIEM rules to minimize false positives, enhance event correlation, and keep pace with evolving threats.
• Document and update SIEM processes and configurations to ensure high data accuracy and availability.

Vulnerability Management:

• Conduct regular vulnerability scans and support patch management initiatives.
• Collaborate with IT teams to prioritize and remediate identified vulnerabilities.

Risk & Compliance:

• Propose solutions to mitigate risks associated with activities that may affect the security of existing IT infrastructure and inform management as necessary.
• Ensure adherence to industry regulations (e.g., GDPR, ISO 27001) and company policies.

Security Policy & Awareness:

• Contribute to the development, implementation, and maintenance of security policies, standards, and guidelines.
• Assist in educating staff on security best practices, including phishing awareness and data protection.
• Help create educational materials and conduct regular security awareness training sessions.

Advisory & Assessment:

• Advise and support internal/external clients on risk assessments, threat modeling, and vulnerability management.
• Conduct risk assessments and recommend security measures to mitigate identified risks.

Your Background:

• Bachelor's Degree or Advanced Diploma in Computer Science, Information Technology, Cybersecurity from an accredited university or a related field (or equivalent experience).
• Strong understanding of cybersecurity principles, practices, and technologies.
• Proficiency in SIEM tools and content management, including rule development, alert tuning, and report customization.
• Experience with security tools such as firewalls, IDPS, antivirus, and vulnerability scanners.
• Knowledge of scripting (Python, PowerShell) for automation within the SIEM environment is advantageous.
• Ability to analyze and interpret security data to pinpoint vulnerabilities and potential threats.
• Exceptional communication skills, capable of conveying complex security concepts to non-technical audiences.
• Strong analytical abilities and meticulous attention to detail.
• Experience with threat modeling or other risk identification methods.
• In-depth knowledge of system security vulnerabilities and remediation strategies, including penetration testing and exploit development.
• Comprehensive knowledge in the information security domain, particularly in TCP/IP network security, operating system security, common attack patterns, and exploitation techniques.
• Relevant certifications (e.g., CompTIA Security+, Certified Information Systems Security Professional (CISSP), Certified Ethical Hacker (CEH), GIAC Security Essentials (GSEC)) are beneficial.
• Strong leadership capabilities and a collaborative team player.
• A solid sense of ownership and motivation.
• Willingness to be on-call or work outside standard hours as necessary to address security incidents.
• Occasional travel may be required for training or workshops.