OneMain Financial

Security Operations Center (SOC) Tier 3 Analyst / Incident Responder

OneMain Financial • $100K — $130K *
Baltimore, MD 21215In-Person
Information Technology
8 - 10 years of experience
Today
Be an Early Applicant
Job Overview by Ladders

Qualifications

  • Expert knowledge of SIEM, SOAR, EDR/XDR, cloud-native security technologies.
  • Advanced proficiency in tools like Elastic Security (ELK) and CrowdStrike Falcon.
  • Deep understanding of Windows/Linux infrastructure, Active Directory, and hybrid cloud environments.
  • Extensive knowledge of networking protocols and authentication methods.
  • Proficiency in KQL, SQL, PowerShell, Python, and Bash for analytics and automation.
  • Familiarity with frameworks like MITRE ATT&CK and NIST CSF.
  • Minimum two relevant cybersecurity certifications; Bachelor's in a related field required.

Responsibilities

  • Lead investigations into ransomware, APTs, and other cyber threats.
  • Perform full lifecycle incident response from detection to recovery.
  • Investigate multi-environment attacks across various platforms.
  • Conduct forensic analysis on diverse systems and workloads.
  • Analyze complex telemetry from security tools and logs.
  • Develop detection rules and enhance security analytics.
  • Engage in proactive threat hunting to identify vulnerabilities.
  • Provide mentorship and reporting support to analysts.

Benefits

  • Opportunity to work with cutting-edge security technologies.
  • Mentorship and leadership development opportunities.
  • Engagement in complex and varied incident investigations.
  • Collaborative work environment fostering continuous learning.
  • Chance to impact security posture in a highly regulated industry.
Full Job Description
Key Responsibilities
  • Lead advanced investigations involving ransomware, APTs, zero-day exploits, insider threats, credential theft, lateral movement, cloud compromise, on-premises systems, VDI, SaaS, API abuse, business email compromise, certificate abuse, and data exfiltration.
  • Perform full lifecycle incident response including detection, triage, investigation, containment, eradication, recovery, validation, root cause analysis, and post-incident review.
  • Investigate attacks spanning on-premises infrastructure, Windows and Linux servers, Active Directory, Active Directory Certificate Services (AD CS), Microsoft Entra ID, Microsoft 365, Azure, AWS, VDI, SaaS platforms, APIs, containers, Kubernetes, databases, enterprise applications, and hybrid cloud environments.
  • Perform forensic analysis of on-premises systems, endpoints, servers, virtual machines, VDI, cloud workloads, identity systems, SaaS applications, APIs, databases, and network devices.
  • Analyze telemetry from EDR/XDR, NDR, SIEM, firewalls, IDS/IPS, WAF, VPN, DNS, DHCP, proxy, email security, cloud audit logs, API gateways, identity providers, application logs, and operating system logs.
  • Develop detections and SIEM correlation rules using Elastic Security, KQL, ES|QL/EQL, SQL, PowerShell, and Python.
  • Conduct proactive threat hunting using MITRE ATT&CK, behavioral analytics, and threat intelligence.
  • Provide technical leadership and mentoring to Tier 1 and Tier 2 analysts.
  • Support management with reporting, including producing technical reports documenting attack timelines, root cause, IOCs, IOAs, TTPs, and recommendations.

Required Qualifications
  • Expert knowledge of SIEM, SOAR, EDR/XDR, NDR, IDS/IPS, WAF, firewalls, email security, web proxies, CASB, DLP, IAM, PAM, API security, and cloud-native security technologies.
  • Expert experience with Elastic Security (ELK), CrowdStrike Falcon, Microsoft Defender XDR, Defender for Endpoint, Defender for Identity, Defender for Office 365, Defender for Cloud, and Defender for Cloud Apps.
  • Deep understanding of on-premises infrastructure including Windows Server, Linux, Active Directory, Active Directory Certificate Services (AD CS), VMware, Hyper-V, storage, virtualization, networking, Microsoft Entra ID, Microsoft 365, Azure, AWS, VDI, SaaS, APIs, containers, Kubernetes, databases, and hybrid cloud architectures.
  • Expert knowledge of TCP/IP, DNS, DHCP, VPN, routing, switching, PKI, Kerberos, NTLM, OAuth, OIDC, SAML, JWT, and certificate-based authentication.
  • Advanced proficiency investigating on-premises systems, cloud environments, endpoints, servers, identity platforms, VDI, SaaS applications, APIs, databases, enterprise applications, and AD CS/PKI-related attacks.
  • Expert proficiency with KQL, ES|QL/EQL, SQL, PowerShell, Python, and Bash.
  • Deep knowledge of MITRE ATT&CK, MITRE D3FEND, Cyber Kill Chain, NIST CSF, NIST 800-61, OWASP Top 10, malware analysis, digital forensics, and attacker methodologies.
  • Minimum two certifications such as GCFA, GCFE, GCIH, GCIA, GREM, CISSP, SC-200, SC-100, AWS Certified Security 6 Specialty, or equivalent.
  • Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or equivalent experience.

Preferred Qualifications
  • Experience in financial services or another highly regulated industry.
  • Experience investigating enterprise incidents across Microsoft 365, Azure, AWS, Elastic, CrowdStrike, and hybrid environments.
  • Experience supporting DFIR engagements involving ransomware, nation-state threats, insider threats, enterprise-scale incidents, and Active Directory Certificate Services (AD CS) abuse.

Experience Requirements
  • Minimum 8 years of progressive cybersecurity experience.
  • Minimum 6 years of hands-on Security Operations Center experience.
  • Minimum 4 years leading complex enterprise incident investigations.
  • Minimum 2 years performing advanced digital forensics, threat hunting, and detection engineering.
  • Proven experience independently investigating incidents from initial alert through full remediation across on-premises infrastructure, enterprise networks, endpoints, identity platforms, Microsoft 365, Azure, AWS, VDI, SaaS applications, APIs, Elastic Security, hybrid cloud environments, and PKI/AD CS.

About OneMain Financial

OneMain Financial is a consumer finance company that provides personal loans and other financial services. The company was founded in 1912 and is headquartered in Evansville, Indiana. OneMain Financial offers loans for a variety of purposes, including debt consolidation, home improvement, and auto financing. The company operates more than 1,500 branches across the United States. OneMain Financial is a subsidiary of Springleaf Holdings, Inc.
Learn more about OneMain Financial
Size
8,800 employees
Market Cap
$4 billion
Industry
Finance & Insurance
Net Income
$730 million
Founded
1912
5 Year Trend
+5%
Revenue
$4.9 billion
NASDAQ
OMF
* Ladders Estimates

Similar Jobs

Ad banner background

Get Ready For Your
Next Interview

More Jobs at OneMain Financial

More Information Technology Jobs

Find similar Security Operations Center (SOC) Tier 3 Analyst / Incident Responder jobs:

NationwideBaltimore, MD