Company:
Mindlance
Location: Boston
Closing Date: 02/11/2024
Hours: Full Time
Type: Permanent
Job Requirements / Description
AnalystCyber Security Operations : The Client is actively hiring a Cyber Security Operations Analyst! Join a great team of cyber security professionals and help us deliver our mission which is to protect the confidentiality, integrity, and availability of Company's digital information and systems.
The Cyber Security Operations Analyst role will be a member of a 4-person team, reporting to the Director of Cyber Security Operations, and will work closely with the Chief Information Security Officer (CISO).
The ideal candidate is a self-starter with a passion for cyber threat hunting, can work in concert with a small team, and demonstrates strong written and verbal communication skills.
Sample Duties and Responsibilities:
Security Operations Response and Reporting:
Review and respond to Security Operations Center alerts.
Review and respond to Endpoint Detection and Response alerts.
Manage Identity alerts and respond to ServiceNow tickets.
Review daily reports, system-generated reports, and threat feeds for relevance or issues.
Splunk SIEM Logs Review and Improvement:
Configure alerts based on gaps in proactive and responsive measures.
Maintain a query repository for regular tasks and improve dashboard visibility across sources.
Ensure data hygiene and CIM compliance with the data model.
Threat Detection & Incident Response:
Conduct threat hunting by tracking common and Client techniques, tactics, Indicators of Compromise (IOCs), and applying measures for detected threats.
Utilize custom Indicators of Attack (IOAs) and EDR SOAR workflows for automated response and remediation.
Review network web proxy and firewall traffic to identify and address consistent abnormal or block events.
Monitoring & Visibility Recommendations:
Develop metrics dashboards for security tools.
Enhance network visibility across firewall and web proxy logs.
Provide recommendations for security improvements, including hardening and content blocking.
Audit and validate the deployment of security controls to meet standards, guidelines, and compliance requirements.
Ensure controls are documented and functioning as intended.
Verify that infrastructure and applications adhere to MassDOT s information security policies and standards.
Audit, report, and maintain a log of all policy violations.
Vulnerability Assessment Responsibilities:
Conduct vulnerability assessments of infrastructure and applications to identify and document gaps and risks.
Communicate identified gaps, risks, and vulnerabilities to customers.
Perform continuous monitoring and analyze the security posture related to infrastructure and applications.
Manage and address events in MassDOT s Security Information and Event Management (SIEM) system.
Monitor and respond to security alerts, including virus alerts, breach notifications, zero-day vulnerabilities, and trending threats.
Additional Responsibilities:
Stay updated on information security issues, best practices, and regulatory changes affecting transportation and information security at both state and national levels.
Develop and recommend security solutions based on business needs, regulatory requirements, and industry best practices.
Understand risk management frameworks and apply them effectively.
Respond courteously and professionally to inquiries from customers, vendors, and colleagues.
Assist with emergencies and events as needed, which may include driving a company or personal vehicle.
Provide on-call support as necessary.
Perform other related duties and projects as assigned.
Provide deskside support to end users when necessary to gather evidence for an investigation, provide advice on safe computing practices, and to diagnose systems as SME for security tools, attack tactics & techniques, and forensic analysis.
Contribute to the continuous improvement of the MassDOT information security program.
Required:
Two plus (2+) years of training or practical experience in IT Operations
Two plus (2+) years of training or practical experience in cyber security operations
Strong work ethic, great time management, and highly inclusive team player
Effective verbal and written communicator, with excellent writing skills
Authorization to work indefinitely in the U.S.
Preferred:
Bachelor's degree or equivalent in Cyber/Information Security
Industry certifications such as CISSP
Previous experience on a Cyber Security Operations team in a large organization
EEO:
Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.
The Cyber Security Operations Analyst role will be a member of a 4-person team, reporting to the Director of Cyber Security Operations, and will work closely with the Chief Information Security Officer (CISO).
The ideal candidate is a self-starter with a passion for cyber threat hunting, can work in concert with a small team, and demonstrates strong written and verbal communication skills.
Sample Duties and Responsibilities:
Security Operations Response and Reporting:
Review and respond to Security Operations Center alerts.
Review and respond to Endpoint Detection and Response alerts.
Manage Identity alerts and respond to ServiceNow tickets.
Review daily reports, system-generated reports, and threat feeds for relevance or issues.
Splunk SIEM Logs Review and Improvement:
Configure alerts based on gaps in proactive and responsive measures.
Maintain a query repository for regular tasks and improve dashboard visibility across sources.
Ensure data hygiene and CIM compliance with the data model.
Threat Detection & Incident Response:
Conduct threat hunting by tracking common and Client techniques, tactics, Indicators of Compromise (IOCs), and applying measures for detected threats.
Utilize custom Indicators of Attack (IOAs) and EDR SOAR workflows for automated response and remediation.
Review network web proxy and firewall traffic to identify and address consistent abnormal or block events.
Monitoring & Visibility Recommendations:
Develop metrics dashboards for security tools.
Enhance network visibility across firewall and web proxy logs.
Provide recommendations for security improvements, including hardening and content blocking.
Audit and validate the deployment of security controls to meet standards, guidelines, and compliance requirements.
Ensure controls are documented and functioning as intended.
Verify that infrastructure and applications adhere to MassDOT s information security policies and standards.
Audit, report, and maintain a log of all policy violations.
Vulnerability Assessment Responsibilities:
Conduct vulnerability assessments of infrastructure and applications to identify and document gaps and risks.
Communicate identified gaps, risks, and vulnerabilities to customers.
Perform continuous monitoring and analyze the security posture related to infrastructure and applications.
Manage and address events in MassDOT s Security Information and Event Management (SIEM) system.
Monitor and respond to security alerts, including virus alerts, breach notifications, zero-day vulnerabilities, and trending threats.
Additional Responsibilities:
Stay updated on information security issues, best practices, and regulatory changes affecting transportation and information security at both state and national levels.
Develop and recommend security solutions based on business needs, regulatory requirements, and industry best practices.
Understand risk management frameworks and apply them effectively.
Respond courteously and professionally to inquiries from customers, vendors, and colleagues.
Assist with emergencies and events as needed, which may include driving a company or personal vehicle.
Provide on-call support as necessary.
Perform other related duties and projects as assigned.
Provide deskside support to end users when necessary to gather evidence for an investigation, provide advice on safe computing practices, and to diagnose systems as SME for security tools, attack tactics & techniques, and forensic analysis.
Contribute to the continuous improvement of the MassDOT information security program.
Required:
Two plus (2+) years of training or practical experience in IT Operations
Two plus (2+) years of training or practical experience in cyber security operations
Strong work ethic, great time management, and highly inclusive team player
Effective verbal and written communicator, with excellent writing skills
Authorization to work indefinitely in the U.S.
Preferred:
Bachelor's degree or equivalent in Cyber/Information Security
Industry certifications such as CISSP
Previous experience on a Cyber Security Operations team in a large organization
EEO:
Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.
Share this job
Useful Links