Principal Cybersecurity Incident Analyst Job at NTT DATA (Melbourne)

Job Description

The Principal Analyst Cybersecurity Incident is a key role responsible for managing and responding to security incidents within the organization. The NTT Cyber Security Incident Response (CSIR) team is essential in providing an orchestrated and rapid security incident response capability with an oversight of security incident response across wider NTT Managed Security Services clients. The CSIR team utilises various security technologies to identify alerts and prioritize and investigate security issues in a fast-paced environment to maintain the level of communication with internal and client stakeholders.

Job Responsibility

Act like a SIEM consultant who provides expertise and guidance to organizations in setting up, managing, and improving their SOC capabilities
Look over dashboards, and reports from the previous day or shift, including checking for any new threats and identifying malware
Prepare for and respond to system breaches or attacks
Respond to hacks or network insecurities and working to prevent new ones
Participate in a shift roster which may comprise of shifts business hours and after hours
Assessing SIEM maturity: Evaluating the existing SIEM setup and capabilities of an organization
Developing or refining the SIEM infrastructure, the architecture, tools, processes, and workflows of a SOC
Implementing security technologies when necessary: Assessing, selecting, and implementing various security technologies such as SIEM, SOAR systems, intrusion detection systems, threat intelligence platforms, and incident response tools
Support the Security Management Lifecycle including: monitoring, investigation, research, correlation, trend analysis, remediation and siem configuration
Developing security policies and procedures: Assisting in developing, documenting, maintaining SOC standard operating procedures (SOPs), incident response plans, playbooks, and other security policies
Actively participate in process improvement with other team members and Wider team
Incident analysis and response: Assisting SOC analysts by providing guidance and support in analyzing security events, investigating incidents, and responding to cyber threats and attacks
Process improvement and optimization: Continuously improving and optimizing SOC processes, workflows, and tools
Threat intelligence analysis: Collaborating with other teams or external threat intelligence providers to gather, analyze, and interpret threat intelligence
Research and recommend mitigation strategies for current and future threats relevant to the Clients environment
Compliance and regulatory requirements: Ensuring that SOC operations align with applicable standards, regulations, and best practices
Incident reporting and communication: Preparing reports and communicating security incidents, vulnerabilities, and findings to stakeholders, management, and internal or external auditors
Collaborating with internal teams
Managing stakeholder expectations and assisting in the reduction of the impact of a cybersecurity event or incident
Provide proactive, constant, and clear communication on the status of incident/problem resolution between the client, NTT, and any other third-party supplier and vendors
Provide remote technical support and Escalations within Managed Services’ ITIL aligned service delivery processes
Manage, own and co-ordinate the technical resolution of incidents either remotely or onsite utilizing Field Engineering resources
Action P1 or Major incident escalation right away
Plan, coordinate and implement complex network changes within customer specified change windows, adhering to a predefined ITIL change management framework
Maintain detailed knowledge of the clients’ environment(s), where applicable, by maintaining and updating relevant documentation
Escalate issues affecting delivery of service to management and mentor the team members and guide them to grow in their roles and provide technical escalation support

Requirements

Bachelor's degree in Information Technology or Computer Science preferred
Relevant certifications such as SANS GIAC Security Essentials (GSEC)
At least 5 years of experience in the technology information security industry
Hands-on experience in administering & managing SIEM platforms Palo Alto XSIAM, Splunk, Microsoft Sentinel etc.
Hands-on experience to Analyse logs/events from SIEM solution, wireshark and other infrastructure
Deep knowledge of cybersecurity concepts, technologies, and best practices
Experience in working in Security Operation Centre and Network Security operations
Hands-on experience in administering & managing Vulnerability Management solutions like Qualys, Tenable etc.
Hands-on experience in administering & managing SOAR Palo Alto Cortex XSOAR or other SOAR solutions
Expertise in writing new and interpreting query language SPL, KQL, XQL
Creating custom dashboards based on the client's security landscape on clients SIEM, Cyber Security Intel products
Experience in managing Security Incidents detection and response, Threat hunt capability with knowledge of Mitre Attack, NIST, FAIR, Cyber Kill chain security framework
Experience in triaging Threat feeds and working towards mitigation exercises
Experience in reviewing the vulnerability, and product bug reports and relating their impact to Clients’ environment
Ability to filter through false positives quickly and focus on true positives
Risk assessment and management: Understanding of risk assessment methodologies and frameworks
Experience with various security monitoring and analysis tools like SIEM, IDS/IPS, EDR, and network traffic analysis tools
Extensive 10 + years of overall experience in a Technology Information Security Industry
Prior experience working in a SOC/CSIRT for at least 8+ years
Good Hands-on experience on Splunk solution creating search rules and dashboards
Tertiary qualifications or a passionate ethical hacker
Experience using End Point Protection products and tools
Experience with Enterprise Detection & Response software
Experience in managing large customers with multiple sites
Strong team player
Ability to work in a challenging and constantly changing environment
Display a willingness to persevere with difficult tasks
Demonstrate resourcefulness and sound judgment
Strong customer service focus with an understanding of client expectations
Strong verbal and written communication, along with good interpersonal skills
High level of initiative, accountability, attention to detail and ability to follow process

Nice to have

Demonstrated genuine interests and passion for cybersecurity
Working knowledge of security operations environments and security incident management & response handling
Certification - Splunk Core Certified Power User (SCCPU), Qualys
Relevant certifications such as CISSP, GSEC, GCIH, GCIA, or other industry-recognized certifications
Exposure to Cyber Security Governance and Risk Compliance (GRC) and experience in providing innovative solutions to complex cybersecurity problems
Strong organisational skills & the ability to prioritise multiple complex tasks
Ability to work effectively under pressure
Excellent verbal and written communication skills are essential to influence both technical and non-technical audiences

NTT DATA - All Job Offers

Select Country

Principal Cybersecurity Incident Analyst

Job Description

Job Responsibility

Requirements

Nice to have

Looking for more opportunities?

Principal Cybersecurity Incident Analyst

Principal Product Manager (Threat Prevention)

Enterprise Security Architect

Store Manager

Chef de Partie

ER Nurse

Relief Female Support Worker - Waking Nights

RN Emergency Department

Clinical Rehab Supervisor

Our AI answers in your language