Full Job Description
Job Summary
We are seeking an experienced Incident Response Analyst to support cybersecurity operations by monitoring, investigating, and responding to security incidents across the enterprise environment. The ideal candidate will have hands-on experience with the CrowdStrike Falcon ecosystem, including sensor management, policy configuration, threat detection, incident triage, containment, and remediation activities. This role involves working closely with the internal security team and SOC provider to analyze threats, manage incident response processes, improve security operations, and protect organizational data and systems from cyber threats.
Key Responsibilities
• Responsible for documenting evidence throughout the incident life cycle, conducting shift handovers, escalating security events to incident response, and providing support during cyber security incidents
• Responsible for the ticket queue triage: prioritization, assignment and disposition of security incident tickets/events.
• Responsible for analyzing threat data from multiple sources and building evidence backed dispositions.
• Responsible for front line triage and response including some containment and remediation actions such as network isolation of hosts and blocking indicators of compromise within security perimeter tools.
• Analyst must keep detailed reports on all analysis activity, documented in the case management tool to validate process adherence.
• Responsible for contributing to the creation and updating of new and existing SOAR playbooks and runbooks and general response documentation.
• Monitor IDB's security detection and response program to protect IDB's Data and IP from both internal and external threats
• Hunt for, detect, and respond to malicious activity and anomalous events on IDB devices and networks
• Utilize IDB tools to automate detection and automatically find and address future vulnerabilities
• Manage/coordinate remediation efforts after security assessment findings outline weaknesses requiring attention.
• Working with the threat modelling lead in Security Architecture to integrate TM tools into the Security Design Review Process.
• Review Vendor software/hardware and Third-Party information security integration controls/risks and document gaps and issues for action.
• Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.
• Foster strong cross-functional relationships internally between Infrastructure, Application teams and external vendors.
What are the top skills required for this role?
a. Incident Response support along with IDBNY team and SOC provider.
b. Would need to understand the broader Crowdstrike Falcon ecosystem
