Role DescriptionAs a Cyber Security Analyst you will be a key part of a high performing SOC team, with a desire to continually improve and advance our capabilities to protect SMBC Group. You will bring your passion for Cybersecurity to a team of like-minded professionals and leverage this passion to ensure our monitoring and response capabilities are effective and efficient and that we keep pace with a rapidly changing threat landscape.
You will relish your core role in supporting the monitoring and response of cyber security alerts and incidents by digging into and investigating them to find the root cause and identifying the gap in controls that allowed a threat to reach that point in the kill chain. If you identify an incident, you will lead that technical analysis, tracking down the actions of that threat actor as part of the incident response, while supported by the wider Incident response process and members of the SOC and CSIRT teams. If you identify a false positive, you will drive the effort to tune or refine our detections, or to drive improvements to our preventative controls to prevent a recurrence, freeing more time for the SOC to focus on improving our skills and capabilities.
As part of a wider team of SOC analysts, you may focus on an area you are passionate about, or if sufficiently experienced, take the lead. You will develop expertise and expand our capabilities in domains ranging from across Purple Teaming, Threat hunting, Digital Forensics and Incident Response (DFIR), Security Automation, Detection Engineering and Threat Intelligence and share this knowledge to develop the depth of knowledge of the SOC. As part of a Financial Group with offices and data centers across the Globe, you will have access and exposure to leading technologies and tools. If there is a gap in our toolset, you can help us identify and bridge that gap by acting as Subject Matter Expert to do so. You will bring fresh ideas, challenge the status quo, and seek always to answer - how can we improve?
This role is best suited for candidates who enjoy and have experience within SOC or CSIRT teams and enjoy investigating and finding the root of an issue or incident and working on getting the most from leading edge security toolsets and platforms and processes. Candidates who excel will think critically to find ways to resolve security challenges. This role would suit an experienced and self-motivated cyber security professional with strong technical skills and knowledge combined with a passion for cyber security.
Role Objectives- Act as a core member of the SOC including Cyber Monitoring & Response/Purple Teaming/Threat Hunting/Digital Forensics/Incident Response.
- Analyze security alerts and respond to security events and incidents.
- Maintain and update monitoring & response playbooks.
- Conduct proactive threat hunting.
- Develop expertise in our monitoring systems and technology to act as an SME in working with our detection engineering and automation teams to enhance our abilities to prevent, detect & respond.
- Test new adversary TTPs and our ability to detect and respond to them.
- Identify opportunities for efficiency, work hand in hand with Security Automation team to automate and improve our response processes.
- Assist in the implementation and ongoing support of security systems.
- Execute tasks or support projects to enhance team's capabilities.
- Follow standards for security excellence within the SOC.
- Bring a positive outlook and seek to motivate and inspire your fellow team members.
- Demonstrate comprehensive understanding of cyber security best practices, risk vectors, mitigation techniques and protection software. Display knowledge of network security concepts and tools such as firewalls, proxy servers, email security and suspicious traffic flows. Exhibit analytical ability in incident response. Show ability to convey cyber security polices and concepts to employees and understand security best practices.
- Strong knowledge of security controls related to the detection, analysis, and response (SIEM, EDR, NDR, XDR, UEBA).
- Strong knowledge of Windows and Linux systems, Active Directory, Cloud technologies.
Qualifications and Skills- 2-5 years of experience in cyber security experience required, ideally in a SOC, DFIR, or CSIRT role.
- Strong verbal and written communication skills with experience in documenting their work to a high level.
- Professional Certifications an advantage but not essential if have requisite role knowledge, GCIH, GNFA, GFCA, Certified Ethical Hacker (CEH), OSCP, CISSP or similar certifications a plus.
- Must be self-directed with the ability to work independently.
- Ability to multi-task and remain productive in a service-driven and results oriented environment.
- Demonstrated strong organizational, analytical, and problem-solving skills.
Additional RequirementsSMBC's employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.
