To be part of Cyber Threat team, tier 3 SME and mentor to the SOC team. This role required continuous detection, analysis, investigation, response, and mitigation of advanced threats before they affected the bank's IT infrastructure via a proven and documented cyberthreat model, e.g., Mitre Attack Framework
Preferred Level Of Experience (by Years / function / industry)
- 4 - 5 years of information security experience
- 1 - 2 years supporting incident response and / or investigations
- Experience reviewing and assessing logs for anomalous activity indicating the presence of a threat
- Knowledge and ability to identify threat actor attack methods and track their developments
- Experience using Threat Model e.g. Cyber Kill Chain & Mitre ATT&CK
- Extensive experience conveying complex information in simple, succinct explanations
- Exceptional attention to detail
Other Skills Required (if Applicable)
Strong technical writing skillsExtensive experience with analytical tradecraftThorough understanding of cybersecurity principlesAbility to work independently and build relationshipsEfficient research methodologiesAbility to relate & convert technical threats with business risksStrong proficiency with scripting and programming languages (e. g. Python, PowerShell, Java, NodeJS, Perl, etc).Strong communication & writing skills for reporting and analysis on cumulative findingsKEY RESPONSIBLITIES
Solution
Maintaining of SIEM solution including Splunk, Imperva and etc. (Task including compliance to patch and obsolescence framework requirement)Ensure events / logs from all relevant devices are sending to SIEM solution in a complete and accurate mannerTo produce monthly SIEM system health report (completeness and accurate)Hunting
Perform threat hunting through industry accepted methodologies including Hypothesis Driven investigation, IOC driven Investigation or Machin Leaning InvestigationAnalyze host, network traffic, IDS / IPS / DLP events, packet capture, firewall logs and other relevant solutionsProvide forensic analysis of network packet captures, DNS, proxy, Netflow, malware, host-based security and application logs, as well as logs from various types of security sensorsIdentify gaps in IT infrastructure by mimicking an attacker s behaviors and responsesPerform offensive validation on identified TTP'sDetection & Response
Continuously develop SIEM use cases based on Mitre Attack framework based on threat landscapeTo onboard all use cases to Security Operation Center for 24 x 7 monitoring and timely responseContinuously onboard new IOC to threat prevention solution to ensure known threat are prevented at all timeContinuously improve processes for use across multiple detection sets for more efficient Security OperationsDevelop dashboards and reports to identify potential threats, suspicious / anomalous activity, malware, etc.Assist in the design, evaluation, and implementation of new security technologies