Our customers and employees deserve to sleep on their two ears, even though cyber-attacks are becoming more frequent. As an Incident Response Analyst, you and your colleagues play a big role in their peace of mind. You review incidents and help determine what needs to be done.
You strengthen the Security Threat Monitoring team within our Security Operations Center. This is a team of experts who are committed to cybersecurity every day.
Monitoring existing security processes, but also making them better. Solving problems, but also preventing them. In a nutshell, that’s what you do as an Incident response analyst.
What do we expect from you?
- You monitor the security of our critical servers and systems.
- You monitor the alarms generated by our security systems and take action on them: you set priorities and escalate an issue when necessary.
- Based on your knowledge of attack techniques, you will help to find the root cause of security alarms. For this you dive into the log files of servers and systems.
- You will test and fine tune security alarms and incident response procedures.
- You will discuss within the teams what to do in case of incidents and how to prevent them in the future.
- You attend regular team meetings and scrums
- You document the context of the incident.
- You help colleagues who are resolving the incident with additional analyses, if necessary.
- You help ensure that we are working according to the right priorities.
- Depending on the action taken on the incident, you close it, put it on hold, have it looked at again or escalate it. Your guide here is our runbook. You also provide suggestions on what action to take.
You participate in sessions on continuous improvement and help think through these questions:
- What lessons can we learn from how certain incidents were handled? Can things be done differently or better next time?
- What are the weaknesses in our security controls?
- Can our processes be more efficient? Do we pass on information to each other in the best way?
Technical Skills
- You have a broad view on the IT Operating systems & middleware (Windows, Unix, Linux, databases) and networks;
- You have general to good knowledge of malware (types) and cyber-attack techniques (the kill chain);
- Other pluses – Knowledge of and experience with:
- security tools for detection and analysis security events
- ticketing systems
- network security, firewall, IDS, …