Lead Analyst Cyber Security

The Cybersecurity Technology Operations Engineer will be a member of the Global Cybersecurity Service Resilience (CSR) team. This team is responsible for the maintenance and operation of all technologies the wider cyber functions rely on. This ensures that the highest standards of availability and security are maintained across all Cybersecurity tooling and that the function will maintain capability in the light of significant organizational disruption.

Main Duties:

• Serve as Security Engineer supporting technical operations for critical cybersecurity technologies.
• Provide end to end administration and production support for cybersecurity tools under Endpoint Security, Data Security, Network Security, Application Security and SIEM/SOAR.
• Analyze, investigate, remediate cybersecurity application incidents in operational/production environment.
• Automate repeated and operational tasks through programming (Perl, Python, PHP, Bash, or PowerShell) or other interfaces.
• Setup monitoring and event management for cyber security products to help manage availability, reliability, and performance.
• Perform cybersecurity application installation, upgrades, product hygiene and maintenance.
• Operate in accordance with ITIL processes such as Change Management process, Incident Management and Problem Management.
• Lead product support transitions on both technical and process front.
• Identify operational gaps and drive continual service improvement plans for existing processes.
• Build tool knowledgebase and establish/enhance Standard Operation Procedures (SOP)
• Work with minimal supervision and conduct activities as a collaborative partner to Cyber Security as well as other lines of business (LOBs)
• Develop and produce operational metrics such as Change success rate, tool uptime report, Incident ticket volume etc.
• The role demands weekend support on rotation through active/passive on calls.

Requirements:

• Relevant experience in tool administration and support of at least 2 + tools in one or more areas is MUST
• Endpoint security (McAfee ENS, CrowdStrike or any EDR solution)
• Network security (ISE/NAC solutions, Network segmentation, Web proxy solutions)
• Application security (Nessus/Tenable, Container/Docker security.)
• Data Security (Industry leading DLP technology such as Symantec or MacAfee DLP)
• SIEM/SOAR (Splunk ES, Splunk SOAR)
• Familiarity with Unix & Windows operating system is a MUST.
• Experience working on Amazon web services (Compute, Storage and Networking) is nice to have.
• Experience with any one of the script languages such as Perl/PowerShell/Python is desired.
• Must possess clear oral and written communication skills and be able to clearly articulate complex concepts to broader audience.
• Excellent analytical and problem-solving skills ability to get to the root of the problem, assess impact, and develop a resolution plan quickly, leveraging all available resources, is essential.
• Must take ownership of tasks and demonstrate high degree of responsibility to ensure completion.