About this role
As part of the Global Cybersecurity Incident Management (GCIM) team you will coordinate containment, eradication and post-incident activities for critical cyber security incidents. You will play a key role in the Incident Response Team (IRT) overseeing, validating and documenting containment acting as a point of escalation for our Global Security Operations Center (GSOC). Following security incident containment & recovery you will be responsible for engaging with key stakeholders for any Root Cause Analysis (RCA) and post-incident activity, ensuring we have reduced the chances of incident recurrence and assessed the efficiency of our incident response techniques and procedures.
What Part Will You Play?
• Coordinate incident response in line with the corporate security incident response plan.
• Manage post-incident activity to include scheduling and chairing Post Incident Reviews (PIR), the documentation of Root Cause Analysis and the tracking of actions to prevent incident recurrence.
• Provides 24x7 on-call incident management support on rotation for critical security incidents.
• Stays up to date with new and emerging threats that can affect the organisation's information assets, third party software/solutions, IT configuration changes, and network/system.
• Provides executive level written communication during incident response for inquiries related to security incidents or assigned cases.
• Coordinate the remediation of findings from the organisation’s Bug Bounty Program working directly with whitehat researchers.
• Works closely with Risk Management teams to document identified risks and issues highlighted through post-incident or root cause analysis activities.
• Maintains a working knowledge of key data security frameworks and regulations such as PCI (Payment Card Industry)/Logical Security guidelines and models, HIPPA (Health Insurance Portability and Accountability Act), (GDPR) General Data Protection Regulation, PII (Personally Identifiable Information), NIST CSF (Cyber Security Framework).
• Collaborates with Legal and Privacy Offices throughout the company on critical data protection/security incidents.
• Participates in reviews and assessments to provide recommendations to enhance or improve the security posture of environments as part of post incident activities and lessons learned.
• Maintain and follow runbooks for day-to-day incident response activities in line with the corporate security incident response plan.
What Are We Looking For in This Role?
Minimum Qualifications
• Relevant Experience or Degree in: Bachelor's degree in Computer Science, Info Security, or related field. Or relevant work experience in a related field.
• Typically Minimum 2 Years Relevant Experience with Incident Management or Incident Response
• Knowledge of network operations or engineering or system administration on Unix, Linux, MAC (Message Authentication Code), or Windows; common security operations, intrusion detection systems, Security Incident Event Management systems, Penetration Testing, Web Application assessment, Secure Coding practices, Cloud Technologies.
Preferred Qualifications
• ITIL V4
• Professional security certifications such as CompTIA Security+/ Cybersecurity Analyst+, or Systems Security Certified Practitioner (SSCP), or CISM(Certified Information Security Manager), or CISA(Certified-Information-Systems-Auditor), or GSEC (GIAC Security Essentials), or GCIH (GIAC Certified Incident Handler)
• Knowledge of industry standard security compliance programs PCI (Payment Card Industry), GDPR (General Data Protection Regulation), NIST Cyber Security Framework etc.)
• Cloud Knowledge or certifications such as Google Cloud Fundamental or AWS Foundations
• Experience working in Google Workspace and JIRA
What Are Our Desired Skills and Capabilities?
• Strong verbal and written communication skills.
• Demonstrated ability to effectively communicate ideas and persuade others to accomplish challenging goals and objectives.
• Ability to facilitate meetings and enable discussions that lead to resolution and communicate results.
• Skills / Knowledge - Developing professional expertise, applies company policies and procedures to resolve a variety of issues.
• Job Complexity - Works on problems of moderate scope where analysis of situations or data requires a review of a variety of factors. Exercises judgement within defined procedures and practices to determine appropriate action. Builds productive internal/external working relationships.
• Supervision - Normally receives general instructions on routine work, detailed instructions on new projects or assignments.
• Industry Knowledge - Continued self-education of new and emerging threats and relevant processes, controls, or technologies to mitigate them.
• Incident Response - Knowledge and skills to contribute to all phases of Incident Response.