Cyber Security Incident Response

Cyber Security Incident Response - Assists in operational support for continuous monitoring of all designated networks, infrastructure and systems. Supports an Incident Response Framework by ensuring preparation, detection, analysis, containment, eradication, recovery and post-incident activities to prevent threats and mitigate cyber incidents.

Responsibilities:

Participates in preparation of incident response actions to ensure security incidents are properly identified and created in a timely manner.

Participates in validating indicators of compromise by investigating ambiguous, incomplete, contradictory, or erroneous indicators to confirm actual security incidents.

Works under supervision when following containment strategies associated to incident types.

Works under supervision in eradication actions to eliminate threat components associated to the incident.

Participates in post-incident activity meetings to improve incident response capabilities and prevent the incident from recurring.

Works under supervision to provides data and deliver summary reports to peers for presentation to leadership.

Works under supervision to utilizes tools for review and monitoring of audit logs, devices, applications, and forensics.

Maintains knowledge of applicable rules, regulations, policies, laws and guidelines that impact. Participates in the creation of effective security controls designed to promote adherence with applicable laws and accreditation agency requirements. Seeks advice and guidance as needed to ensure proper understanding.

Document procedures necessary for the implementation of Information Security Policies and Standards.

Identifies ways to improve work processes and improve customer satisfaction. Makes recommendations to supervisor. Works under supervision to implements and monitor results as appropriate in support of the overall goals of the department.

Stays abreast of the latest developments, advancements, and trends in the field of Cyber Security Incident Response by attending seminars/workshops, reading professional journals, and actively participating in professional organizations. Integrates knowledge gained into current work practices.

• Bachelor's degree in Computer Science or related field or the equivalent of education, professional training, or work experience. - [REQUIRED]
• Must have one year of experience in an information systems security domain. - [REQUIRED]
• Background in intrusion detection monitoring, incident response and mitigation, threat research and cyber intelligence analysis or other cyber security domain. - [HIGHLY PREFERRED]
• CompTIA Security Certification preferred or equivalent in industry certification, background, and knowledge. - [HIGHLY PREFERRED]
• Must be able to analyze and correlate security information with other relevant data sources.
• Must have the ability to perform research to determine industry standard products and solutions to facilitate creation of security mitigation controls / recommendations.
• Prefer experience in Agile Methodologies.
• Prefer experience in contributing to audit requirements.
• Must have effective writing skills and the ability to communicate clearly regarding technology.
• Must have well rounded documentation skills.
• Must have a general understanding of the following technologies: Microsoft Active Directory, Data Loss Prevention, Encryption Technologies, Vulnerability Management, Intrusion Detection Systems, Intrusion Prevention Systems, Virtual Private Network, Linux Operating Systems, Windows Operating Systems, Communication Protocols, Multi-factor authentication, Cloud Access Security Broker, Endpoint Detection and Response Technologies, Security Information and Event Management Tools
• Must be able to listen and communicate effectively.
• Must be willing to work in an on-call situation.