The posting
Make an impact by:
- Act as the Enterprise Cyber Security technical focal point during cyber incidents, working closely with SOC, CISO, infrastructure, network, cloud, application, and vendor teams.
- Support cyber incident response activities including triage, investigation, containment coordination, evidence gathering, remediation tracking, and post incident review.
- Conduct proactive threat hunting across Enterprise infrastructure using available telemetry from SIEM, EDR, NDR, vulnerability management, asset discovery, and other security tools.
- Identify suspicious behaviours, attack patterns, lateral movement indicators, privilege misuse, exposed services, anomalous access, and other signs of compromise.
- Develop and enhance threat hunting hypotheses, detection use cases, investigation playbooks, response procedures, and escalation workflows.
- Support improvement of security monitoring by identifying gaps in logs, telemetry, asset visibility, EDR/NDR/SIEM coverage, and detection rules.
- Work with SOC and central security teams to improve alert quality, detection coverage, investigation context, and incident response readiness.
- Support vulnerability management and risk-based remediation by correlating vulnerabilities with asset criticality, exposure, threat intelligence, and compensating controls.
- Support Enterprise cybersecurity initiatives including NDR deployment, asset discovery, micro-segmentation, Zero Trust controls, PIAM/IAM adoption, and security tool integration.
- Participate in security assessments, threat reviews, tabletop exercises, incident simulations, and lessons-learned activities.
- Support root cause analysis and ensure remediation actions from cyber incidents, audit findings, vulnerability reviews, and threat hunting activities are tracked to closure.
- Prepare management reports, investigation summaries, threat hunting findings, risk updates, incident dashboards, and security posture metrics.
- Support cybersecurity audits, regulatory requests, internal governance activities, and evidence collection where related to incident response, monitoring, and security controls.
- Maintain and improve technical documentation including incident response runbooks, threat hunting procedures, SOPs, escalation guides, and operational checklists.
- Provide guidance to internal teams on security best practices, incident handling, evidence preservation, secure configuration, and remediation actions.
Skills for Success:
- Bachelor’s degree or diploma with relevant experience in Cybersecurity, Information Technology, Computer Science, Engineering, or a related field.
- Minimum 7 years of experience in cybersecurity operations, incident response, threat hunting, SOC operations, detection engineering, infrastructure security, or related roles.
- Strong understanding of cyber incident response lifecycle, including detection, triage, containment, eradication, recovery, and post-incident review.
- Hands-on experience with security technologies such as SIEM, EDR, NDR, vulnerability management, threat intelligence platforms, asset discovery tools, firewalls, and endpoint/network security controls.
- Good understanding of network security, TCP/IP, routing, firewalls, VPNs, DNS, authentication, Windows/Linux systems, Active Directory, and cloud security fundamentals.
- Experience analysing logs, alerts, network traffic, endpoint telemetry, user activity, and security events to identify threats or suspicious behaviours.
- Familiarity with MITRE ATT&CK, Cyber Kill Chain, threat hunting methodologies, and common attacker tactics, techniques, and procedures.
- Ability to work across multiple teams during incidents and security projects, including SOC, CISO, infrastructure, network, application, cloud, GRC, and vendor teams.
- Strong analytical, troubleshooting, documentation, stakeholder management, and communication skills.
Preferred Certifications and Skills
- Relevant incident response or threat hunting certifications such as GCIH, GCIA, GCFA, GNFA, GCFE, CySA+, or equivalent.
- Cybersecurity certifications such as CISSP, CISM, Security+, or equivalent are advantageous.
- SIEM, EDR, NDR, or cloud security certifications from platforms such as Microsoft Sentinel, Splunk, CrowdStrike, Palo Alto, AWS, or Azure are preferred.
- Experience with scripting, automation, and data analysis using PowerShell, Python, KQL, SPL, APIs, or similar technologies.
- Exposure to tools and technologies such as Microsoft Sentinel, Splunk, CrowdStrike, Tenable, Qualys, Darktrace, Palo Alto, Illumio, CyberArk, Delinea, Device42, or similar platforms.
- Experience working in complex, regulated, telecom, infrastructure-heavy, or enterprise-scale environments.
