Cyber Security Analyst: Forensics at Sanlam Group

What will you do?

The role of the Cyber Security Analyst will form part of the Sanlam team which focusses on Cyber Security Monitoring and Response. This role will have specific responsibilities related to the gathering, analysis and preservation of forensically sound evidence during a cyber incident. The Group Cyber Security Centre team is responsible for identifying potential cyber-attacks and preventing it or limiting its impact on the business operations of the Sanlam Group.

What will make you successful in this role?

On a day-to-day basis, the Analyst will be monitoring and responding to Alerts generated by:

• SIEM
• EDR
• Honeypots
• Threat Intelligence Sources
• Reported via communication channels
• Support business forensics as well as the internal CSIRT by providing Cyber forensic services which include:
  • Evidence acquisition, handling, analysis, and reporting.
  • Reporting on findings of forensic investigations
  • Support the CSIRT as the first responder;
  • Transfer forensic knowledge to other CSIRT members and first responders within the Sanlam group of companies;
  • Assist in improving the security monitoring capability by applying knowledge attained during forensic investigations.
• Perform malware analysis
• Acting as an expert witness in disciplinary proceedings and court
• Interacting with external forensics companies, incident responders and law enforcement during investigations
• Managing and improving the current forensic lab processes and infrastructure
   

Qualification And Experience

• At least 3 - 5 years in hands-on forensic investigation
• Formal certification in forensics
• Experience in using either FTK (Forensic Toolkit) or IEF (Internet Evidence Finder); Cellubrite; UFED (Universal Forensic Extraction Device)
• Some malware analysis and/or CSIRT/SOC experience will be beneficial
• Exposure to Threat and Vulnerability Management would be beneficial

Knowledge And Skills

• Security Auditing
• Risk management
• Incident Investigation
• Reporting and Administration
• Security tools monitoring

Personal Attributes

• Interpersonal savvy - Contributing independently
• Decision quality - Contributing independently
• Plans and aligns - Contributing independently
• Optimises work processes - Contributing independently

Core Competencies

• Cultivates innovation - Contributing independently
• Customer focus - Contributing independently
• Drives results - Contributing independently
• Collaborates - Contributing independently
• Being resilient - Contributing independently