Cyber Security Analyst | Full Time

GENERAL SUMMARY:

Reporting to the Information Security Services Manager, the Cyber Security Analyst is an operational role focusing on real time security event monitoring and security incident response. As a Cyber Security Analyst, you will actively manage the continuous protection of systems and information assets by contributing to or leading teams in the execution and implementation of information security defense improvements involving architecture, processes, tools and automation. This includes protecting both cloud and on-premises infrastructures, monitoring events by identifying suspicious activity and conducting incident investigation leading to the remediation of attack. Working with IT members you will carry out in-depth threat intelligence analysis to find the perpetrator, the type of attack, and the data or systems impacted. The Cyber Security Analyst position is a valued member of the Information Privacy & Security Office (IPSO) department and will work closely with other members of the SOC, IPSO (Risk, Privacy, etc.) and IT programs to develop and implement a comprehensive approach to the management of security risks.

PRINCIPLE DUTIES AND RESPONSIBILITIES:

• Rapidly respond to alerts and incidents reported by security systems and employees.
• Escalate incidents as required to other security team members and/or the Infrastructure Team.
• Continuous monitoring, prioritization, identifying security incidents and remediation of vulnerabilities.
• Threat hunting utilizing SIEM (QRadar) or other data analytics solutions (CISCO Stealthwatch, ISE, Cisco secure endpoints etc.)
• Perform phishing investigations (ProofPoint, Azure ATP) and response.
• Ensure that all security events are properly documented/tracked to meet audit and legal requirements
• Working closely with IT/legal towards the continuous improvement of the service.
• Create and maintain documentation for existing and new security systems and processes.
• Manage and configure security tools (SIEM, EDR, DLP etc.).
• On call rotation 24x7 shift environment.
• Other duties as assigned.

Technology Requirements:

• NGAV products (Carbon Black, Cisco secure endpoints, Crowdstrike).
• Email defense (Proofpoint, Mimecast, Exchange Online ATP).
• Vulnerability Management (Tenable, Rapid7 InsightVM, Qualys).
• Security Awareness Platforms (KnowBe4, PhishMe, Ninjio).
• Active Directory.
• Networking and server knowledge.