Cyber Security Engineer

Job Description

Perform Security incident response. Monitor alerts across Security Stack and provide advanced detection and response service though security event analysis review. Perform incident handling and response, including Investigate and analyze security incidents, identify root cause, and develop appropriate mitigation strategies. Perform threat hunting and proactive analysis to identify potential security risks and vulnerabilities. Maintain current knowledge of tools and best practices in forensics and incident response and develop an understanding of advanced persistent threats, including tools, techniques, and procedures of attackers. Help navigate Orica staff from incident response triage into the incident response process if findings are substantiated. Work with the senior security engineers and analysts in fine tuning the security systems removing any false positive alarms. Lead security vulnerability management program recommending best practices/solutions to address vulnerabilities, secure hosts, applications, databases, and network technologies. Strengthen security operations monitoring by extracting data from threat intelligence and develop understanding of adversary TTPs. Monitor the performance of security solutions to identify and bring to attention breaches and potential intrusion incidents. Monitor security logs and alerts from various sources, including but not limited to intrusion detection systems, Endpoint Detection and Response (EDR) systems, and security information and event management (SIEM) tools. Execute security response actions, including full remote remediation of endpoints and other Orica Assets. What you will bring Tertiary level qualification in IT related discipline; or related industry qualification and industry experience. 5 + years experience working a security engineer or similar Cyber Security role. 3 + years cybersecurity experience including risk assessments, systems engineering, and secure architecture required 2 + years experience as a Systems Administrator (windows Linux Experience in investigating threats, utilizing OSINT, closed sources, and other research techniques to uncover threat actors and their TTPs while providing context to threats and reaching conclusions from incomplete or missing data. Technical know-how on extracting threat data (IPs, domains, ports, malware, and malicious communications) from multiple sources Experience working with cloud security and governance tools, cloud access security brokers (CASBs), and server virtualization technologies required Working knowledge on cloud platform from AWS, Microsoft Azure At least one Information Security industry certification such as SSCP, CISSP, CEH, CCNA, SANS GIAC Security Certifications (GSEC / GCED / GSIP). Knowledge of ISO 27001/2, NIST CSF and related standards/frameworks, privacy legislation and security policies.

More Info

Education