The posting
Functional overview
- A WorldWide leading Automotive Retail & Distributor is setting up a Security Platform as a centralized function within an organization employing people, processes, and technology to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents.
Duties and Responsibilities
- 4+ year of experience working in a NOC or SOC as System Administrator
- 4+ year of Security Incident Response experience
- 4+ years of networking and/or security experience
- 2+ years of experience in Security Management and SIEM (e.g., Splunk, OSSIM, AlienVault)
- 2+ years of experience with Ticket Management Tools (e.g., ManageEngine)
- Possession of Industry Certifications (Security+, SSCP. GCIA, CISSP)
- 2+ year of experience of event/alert management, incident and change management processes.
- 2+ year of experience of Command and Control (CnC), Indicator of Compromise (IoC), DDOS, Email Phishing, Brute Force Attacks, Event log analysis
- Knowledge of and experience with intrusion detection/prevention systems and security software
- Strong knowledge and understanding of network protocols and devices.
- Strong experience with Windows, and Unix systems.
- Proficiency in Microsoft Office programs and ability to learn specialized system tools
- Ability to analyse event logs and recognize signs of cyber intrusions/attacks
- Preferred but not required:
- Experience in network/host vulnerability analysis, intrusion analysis, digital forensics, penetration testing, or related areas
- Qualifications such as CISSP, Security +, Network +, CEH, RHCA, RHCE, MCSA, MCP, MCSE and knowledge of NISP /equivalent industry standard is preferred
- Familiarity with tools such as Cyciv, Sentinel One, ProofPoint, Netskope, Intruder, ManageEngine, Security ScoreCards, Last Pass
- Minimum bachelors’ degree in Information Security, Computer Science, or other IT-related field. Exceptional candidates with proven experience in security/network operations will also be considered.
Minimum competencies
Minimum Qualifications
- SECURITY SYSTEMS ADMINISTRATOR
- Maintain and manage border security systems, such as intrusion detection systems and firewalls. They support, monitor, and take care of existing configuration changes for Security Systems.
- The administrator is conversant with procedures, such as change management, automation, and revision control. They need to configure and deploy security operating platforms and maintain it.
- Administrator coordinates, schedule, and conduct hardware and software enhancements, upgrades, reconfigurations, and patches. They coordinate with engineering and business units to deploy and implement best practices to meet the objectives of the organization.
- Install and configure Security hardware operating systems and applications. Apply patches & fixes
- Security tooling operation and administration
- Lead the implementation and maintenance of security tools that provide insight in to Company’s security environment. The Security Administrator will monitor alerts and investigate security events via Company tooling to investigate suspicious activities; leading containment and prevention, as well as supporting recovery.
- Engineers aid in fixing network security issues of our infrastructure, suggest recommendations after researching best industry practices, creating documents for its configuration and installation.
- Review client requirements for security systems and collaborate with other engineers and developers to decide on an overall technical approach
- INCIDENT RESPONSE & RECOVERY
- Responsible for Incident Response work that includes identifying attack vectors, providing malware removal strategies, backup and restoration strategy, identifying IOCs, and compromised host isolation techniques.
- Responsible for Malware analytics & vulnerability assessments that assist in identifying and mitigating MiTM, Ransomware, and Heartbleed attacks, as well as perform vulnerability scans and penetration testing.
- Assists with ACL recommendations and router/switch/firewall configurations.
- Response to alerts from information security tools & reports, investigates and resolves security incidents.
- The Security Analyst Tier 2 is responsible to educate and communicate security requirements and procedures to all users and new employees.
- Identifying & coordination the information security incident process, including investigating or working with relevant teams to deal with the incidents, identify the root cause and amend policies when required
- Document all incidents and create a clear narrative that supports their conclusion
