The posting
Mid Level Cyber Security Analyst austin, tx
https://kforce.workllama.com/atsuser/referral/WmNnOD?utm_source=workllama_share&utm_campaign=tp&utm_medium=referral
to work on the CISO Security Operations Center team - supporting the rapid threat detection and response mission. This role is located in Austin, TX (hybrid onsite - 3 days a week). Summary: As a Cybersecurity Analyst, you will perform security monitoring, investigations, and response to thwart internal and external threats to the client's environment. The Security Operations Center has a global footprint and is responsible for monitoring 24x7 monitoring and incident response. Additionally, you will collaborate on an ongoing basis with the Cyber Security Rapid Response Incident Response Team and other security teams to support detection, triage, incident analysis, containment, remediation and reporting of events/incidents while coordinating, balancing business priorities, emerging and actual threats and best practices to ensure the confidentiality, integrity and availability of information assets. This role may include daytime, evening or overnight and weekend shifts to meet business requirements and fulfill the 24x7 mission. Duties:
Drive the global security monitoring and rapid response mission across the team
Detect, respond, mitigate, and report on cyber threats/incidents that may impact the environment
Model effective communication and response to internal stakeholders within your investigations
Improve runbooks, processes and response capabilities
Resolve problems independently and understand escalation procedures
Participate in security incidents and act as the technical Subject Matter Expert during significant security incidents
Collaborate with technical leads: Engineering, Operations, Service Desk, Applications and BISOs on matters related to security monitoring across global footprint
Act as an internal information security consultant to the business and technology units, advising on risks, threats and control practices related to Rapid Response
2+ years of information security related experience
Experience with security operations, security engineering, risk management, vulnerability management, threat analysis, security auditing, incident response and other information security practices preferred
Strong knowledge of cloud computing and network protocols
Knowledge of industry information security standards/frameworks (NIST, MITRE, FEDRAMP)
Experience working with SIEM tools and log analysis
Knowledge of EDR tools and endpoint analysis
Excellent written and oral communication skills with the ability to effectively communicate with information technology professionals as well as senior management and auditors
High level of personal integrity, and the ability to professionally handle confidential investigations and exude the appropriate level of judgment
Preferred:
Bachelor's degree
Relevant IT security industry recognized certifications (CASP, CISSP, GCIH, GCIA, GMON, OSCP, etc.)
4+ years of information security experience in a security operations or engineering role
Strong understanding of networking protocols and firewall management
Enterprise experience in incident response or security operations environment
Experience with programming or scripting languages
Experience tuning rules within SIEM tools like Qradar
Strong experience with EDR platforms, such as Crowdstrike, Microsoft Defender 365, Uptycs or Carbon Black, conducting analysis as part of investigations
Experience with cloud computing platforms, e.g. IBM Cloud, Amazon Web Services, Azure
Experience with host virtualization platforms, e.g. VMware, Hyper-V
Experience with application container technologies, e.g. Kubernetes
Purple team experience conducting attacker simulation and adversary emulation
System administration skills for Windows and Linux
Windows, Linux and/or Mac forensics
