Sr. CyberSecurity Incident Response Analyst

Description

The Senior CyberSecurity Incident Response Analyst is responsible for leading the enterprise-wide incident identification and resolution program. This role involves designing and implementing new incident management solutions, ensuring adherence to the corporate incident response plan, and providing high-quality service in line with the organization's standards.

LOCATION; UTAH

MOUNTAIN AMERICA CENTER

9800 S MONROE STREET, SANDY UT 84070

SCHEDULE: FULL-TIME HYBRID IN UTAH

To be effective, an individual must be able to perform each job duty successfully.

Lead an enterprise-wide incident identification and resolution program within the business environment.
Lead and manage incident management activities with a high level of quality service and MACUWay.
Efficiently document and review complex security incident reports.
Create and maintain dashboards and periodic reports to document historical threats, suspicious/anomalous activity, malware, etc.
Develop and execute processes to restore normal service operation as quickly and securely as possible in the event of an incident to ensure Service Level Agreements are met.
Lead post-mortem processes and reviews; test fixes to ensure lessons learned have been adequately resolved.
Establish and follow guidelines for log reviews and security community threat intelligence.
Lead and participate in incident response training sessions.
Correlate and analyze data from intrusion detection and prevention systems with data from other sources such as firewall, web server, and DNS logs.
Assist in "hunt missions" using threat intelligence, analysis of anomalous log data and scripts, and results of brainstorming sessions to detect and eradicate threat actors.
Respond and investigate alerts for IDS/IPS/NextGen firewall, next-generation malware protection, web proxies, DLP tools, and email spam filtering.
Assist in forensics and packet-level analysis on servers, endpoints, and appliances.
Maintain and validate the chain of custody for all evidence collected during incidents and security investigations.
Design and execute internal phishing simulations.
Assist in analyzing phishing emails/calls/texts to team members and members.
Conduct and oversee employee security training.
Monitor, detect, analyze, and respond to cyber threats and incidents.
Correlate and analyze events and data to determine the scope of cyber incidents.
Acquire and analyze endpoint and network artifacts, volatile memory, malicious files/binaries, and scripts.
Document investigation and incident response actions in Archer and prepare formal incident reports.
Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
Tune and maintain security tools (e.g., EDR, IDS, SIEM) to reduce false positives and improve SOC detection capabilities
Perform other duties as assigned.

KNOWLEDGE, SKILLS, and ABILITIES

The requirements listed are representative of the knowledge, skills, and/or abilities required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential job functions.

Experience

4 years of directly related experience.
Extensive experience in incident response, cybersecurity, and threat analysis.
Strong knowledge of security platforms and tools (e.g., SIEM, EDR, IDS, DLP).
Excellent analytical, problem-solving, and communication skills.
Ability to work independently and as part of a team.
Strong understanding of cybersecurity regulatory requirements and best practices.

Education

Four-year college degree or equivalent experience. Relevant certifications such as Security +, Project +, Web Security Associate, GCFE, or equivalent.

Licenses, Certifications, Registrations

N/A

Managerial Responsibility

No Managerial Responsibility. However, this position is a senior position and will require mentoring and working with others on the team.

Computer/Office Equipment Skills

Demonstrated proficient skills with Microsoft Office Suite including Outlook, Word, PowerPoint, and Excel.
SIEM
EDR
DLP

Language Skills

Demonstrated ability to clearly communicate verbally and in writing.
Demonstrated ability to read and follow instructions.

Other Skills and Abilities

Demonstrated excellent customer service skills.
Proactively solves problems and actively improves processes and create efficiencies.
Professional, exercises personal discretion and independent judgement.
Adaptive to change, responds positively to altered circumstances or conditions.

Excellent inter-personal skills, including the ability to lead and collaborate with multiple teams.
Possess a desire and willingness to learn and continually update knowledge of financial concepts, strategies, systems etc.

PHYSICAL ABILITIES / WORKING CONDITIONS

Physical Demands

Ability to sit, talk and hear consistently

Ability to stand, walk, and use hands to handle or reach occasionally

Vision Requirements

Close vision (clear vision at 20 inches or less)

Distance vision (clear vision at 20 feet or more)

Weight Lifted or Force Exerted

Ability to lift up to 25 pounds occasionally may need to lift up to 50 pounds.

Environmental

There are no unusual environmental factors (such as a typical office)

Noise Environment