Senior Incident Handler, Cyber Security

Security Operations Monitoring:

• Manage the investigation of alerts raised to identify a security incident. Close false positive alerts after triage.

• Analyzing security events to identify threats and recommend actions

• Manage the implementation of security controls and incident response processes

• Contributing to team training and knowledge-sharing

• Lead in 24/7 security operations and responding to incidents

• Document a daily update for all alerts investigated and their outcome. The update should be provided to the Head of Cyber 7PM.

• Document triage report for all alerts that have been investigated

• Lead the identification, prioritization, and implementation of use cases

• Work with other departments to ensure logs for all servers and network devices are integrated with the SIEM

• Manage operational relationships with third-party SOC providers

• Ensure SLAs are met for identifying and investigating an alert

Threat Hunting:

• Support threat hunting lead to conduct threat hunts based on iOS received from various sources

• Review ad produce threat hunting reports with recommendations

• Oversee the continuous improvement to the current threat hunting procedure

Security Investigations and Incident Response:

• Support the cyber team to investigate a cyber breach this will include

• Investigating via EDR platform

• Log analysis

• Forensically imaging systems identified as being compromised

• Analyzing any data collected

• Provide recommendations on gaps identified during an investigation

• Ensure chain of custody is maintained throughout an investigation

• Ensure the incident management plan is followed through the lifecycle of an incident response

• Review, approve, and present investigation findings and post-incident reports to management and relevant stakeholders.