Specialist: Security Monitoring and Triage at MTN

Job Description

• The Specialist: Security Monitoring and Triage will be responsible for assisting with the provisions of 24/7 operations and management of all alerts generated by the SIEM. The incumbent will provide this service to tier one, two and three OpCos. The incumbent will also be responsible for anomaly detection and ensuring that MTN SOC security platforms are able to cover MTN Group’s attack surface.

Context

MTN is an emerging market mobile operator at the forefront of technological and digital changes. We deliver a bold, new digital world to our customers across Africa and the Middle East – one of the world’s fastest-growing regions for mobile telecommunications. We believe everyone deserves the benefits of a modern connected life.

With the changing global business landscape, cyber risks organisations face are on the rise. If these cyber risks are not correctly managed, new vulnerabilities could compromise customer data confidentiality, integrity and availability, ultimately affecting the performance of networks and information systems.

To proactively manage our cyber risk exposure, MTN Group has established a Cyber Security Operations Centre (CSOC). The mission of the CSOC is to improve the security posture of the Group against the threats it faces as a consequence of its business activity in the cyberspace by helping to prevent, detect, mitigate and respond to cyberattacks and by acting as the cyber-security information exchange and incident response coordination hub for all the OPCOs. MTN’s CSOC provides a holistic approach to manage both external and internal threats’ lifecycle. The MTN CSOC service catalogue includes the following activities:

• Firewall Management
• SIEM - Implementation and management
• SIEM - Intelligence
• 24/7 Monitoring and Triage
• Cyber Threat Intelligence
• Threat Hunting
• Vulnerability Management
• Cyber Incident Response
• Forensic Analysis

Responsibilities
Key Performance Areas

4/7 Monitoring

• Provide technical 24/7 Monitoring expertise to tier one, two and three OpCos.
• Analyse new incidents to determine the required level of technical support.
• Conduct a primary assessment at level 1 to determine whether the new incident is a real threat.
• Examine and analyse information gathered to verify real incidents and classify security incidents according to the classification schema for MTN Information Security Incidents.
• Escalate the incident to Level 2 for advanced investigation, following the Incident Management methodology.
• Reduce the false-positive rate to be able to identify every incident correctly and optimise service quality.
• KPI: Ensure the efficient and effective delivery of 24/7 Monitoring services for MTN Group and its OpCos.

General Operations

• Perform allocated tasks according to Standard Operating Procedures (SOP) or instructions.
• Assist and provide support to colleagues with executing required tasks and activities.
• Resolve queries timeously or escalate to relevant stakeholder(s).
• Conduct effective document management, including accurate electronic and/ or paper filing systems.  
• KPI: Ensure work is delivered in a professional and efficient manner.

Reporting

• Extract the necessary raw information to elaborate the relevant technical reports.
• Provide information as appropriate for reports specific to area of responsibility on daily/ weekly/ monthly basis.
• File, archive and retrieve documents as and when required.
• Maintain and update records and systems as required.
• Retrieve supporting documentation and records to facilitate and support query resolution.
• KPI: Ensure reporting requirements are complied with and accurate information is disseminated to support specific decisions or actions.

Ways of Working

• Leading by Connecting: Connect people; stimulate collaboration and growth in teams across functions, operations and different cultures. Share experience and knowledge that leads to a learning organisation, creating sustainable expertise which drives the development of people and innovative products,
• Leading by Delivery:  Anticipate situations and take initiative to overcome them. The result is a swift and on time delivery of qualitative and quantitative results.
• Leading by Vision: From analysing the situation inside and outside the company and seeing opportunities until communicating the vision of the company including new ideas for sustainable business strategies, products, services and ways of working. The end result is an inspiring vision on how to succeed in our markets with our consumers in the center.
• Leading by Change: From embracing change until leading and facilitating the implementation of change and handling of resistance for senior people. The end result is an on time implementation of change projects and actions while maintaining a high level of motivation and commitment.
• Leading by Owning:  Take responsibility for own results as well as for company results and values. Stimulate this attitude in others, make co-workers accountable. The end result is pro-activity, creativity and motivation: capable people who take ownership.

Qualifications
Job Requirements

Education:

• Three year tertiary qualification in Computer Engineering or similar
• Certified Ethical Hacker (CEH), Certified Cisco Certified Network Associates (CCNA) or related certifications

Experience:

• 3 years of relevant work experience in 24/7 Monitoring
• Experience with low and medium security incidents containment, eradication and recovery.
• Experience in level one playbook creation and maintenance.

Other

• Fluent in English
• Multi-country operations oversight experience
• Willing and flexible to travel within Africa and Middle East
• Understanding of general regulatory requirements in the telecom industry as it relates to 24/7 Monitoring
• Global mindset to service worldwide operations
• Telecommunications industry experience would be beneficial
• Pan Africa and Middle East multi-cultural experience would be beneficial