Incident Response Specialist (Group Tech - Information Security) at Investec

Description

• We are looking for a Senior Cyber Security Incident Response Specialist to join our global Incident Response (IR) team. As an incident responder, your primary responsibility will be to triage, investigate and remediate reported security incidents within the environment. However, this role will also require you to become a key part in the development of the IR Team's capabilities, improving security monitoring workflows and developing custom tooling. 

Key responsibilities

• Performing hands-on investigations of Cyber Security incidents from triage through to closure.
• Research and implement new playbooks that can be used within the IR team's SOAR platform.
• Continually assess the effectiveness of the SOAR platform and assist in developing strategic work items to improve the IR function.
• Assess potential threats to the environment, developing detection mechanisms and response methodologies. 
• Conduct advanced investigations into targeted and persistent threats, using forensic, network, and behavioural analysis to uncover the full scope and impact of security incidents.
• Correlate evidence across endpoints, networks, and cloud platforms to reconstruct attack paths and identify adversary intent.

Core Competencies

• Ability to communicate technical information between different teams across the organisation
• Strong customer focused thinking
• Effective written and oral communication skills 
• Strong documentation skills 
• Willingness to share ideas and collaborate with various teams

Experience, skill and capability

• 4+ years of experience (or equivalent) with security analysis and incident response (e.g., working within a SOC/CSIRT/CERT) within regulated environments. 
• Experience responding to and containing live security incidents such as ransomware, data breaches and advanced targeted attacks following a standard incident handling process.
• Expert skills in three or more of the following: SIEM, networking, EDR, SOAR or cloud infrastructure.
• Understand the totality of a threat across multiple technologies, demonstrating the ability to think like an attacker. 
• You must be comfortable with conceptualizing, developing and delivering automated responses to security incidents.
• Experience in developing tooling integrations and creating custom toolsets for incident analysis.
• Vendor independent qualifications in Digital Forensics and Incident Response, e.g., GIAC, CREST, ISC2, EC-Council, IACIS, etc. would be beneficial.  
• Experience working with Azure/MS365 offerings, common attack techniques utilized by threat actors against these platforms and potential IR responses.
• Solid understanding of technical and security domains fundamental to investigations and incident response including:
• Client-Server infrastructures, security architectures and related logging and alerting. 
• TCP/IP networking with the ability to perform deep-dive network forensic analysis.
• File-system analysis with the ability to find and extract common disk-based indicators of compromise.
• Windows and Linux with emphasis on memory structures and ability to find common memory-based indicators of compromise.
• Malware analysis activities using behavioural techniques. Ability to perform dynamic and static analysis is an advantage.