EY - Lead Analyst - Forensic Investigation - Cyber Defense Response Center

Cyber Defense Response Center (CDRC)

Lead Analyst - DFIR

This role will work collaboratively with team members and managers to respond to and resolve information security incidents, maintain and follow procedures for security alerting, and participate in security investigations. This role should be capable of identifying vectors of threats and incidents, and develops documentation to support the incident response process. They are also responsible for activities as they relate to the security program including event detection, event triage, event reporting and follow-up activities. The role articulates security issues and recommendations to IT project teams and management.

Essential Functions of the Job :

- Contributes to the creation and maintenance of the enterprise's security architecture design and security documents (policies, standards, baselines, guidelines, and procedures)

- Contributes to the integration and initial configuration of all new security solutions and of any enhancements to existing security solutions in accordance with standard best operating procedures generically and the enterprise's security documents specifically by taking direction from management and teaming efficiently with peers.

- Proactively identifies potential information security problem areas and proposes recommendations that would minimize IT security violations

- Conducts studies of industry trends and developments enabling active assistance in identifying and prioritizing security-related requirements, promoting secure-by-default designs, and maintaining that information systems and infrastructure will be secured throughout system development life cycle

- Documents security findings, reports these to management, and validates remediation has been completed and the steps that were followed

- Contributes to providing the mandatory and recommended IT security controls so they are appropriately implemented in the infrastructure and information systems across the firm

Analytical/Decision Making Responsibilities:

- Contributes to maintaining the confidentiality, integrity, and availability of the data residing on or transmitted to/from/through enterprise workstations, servers, and other systems and in databases and other data repositories by following and enforcing IT security standards, policies and procedures

- Recognizes successful intrusions and compromises through review and analysis of relevant event detail information.

- Engages in ongoing communications with peers in the Systems and Networking groups as well as the various business groups to allow for enterprise wide understanding of security goals, to solicit feedback and to foster co-operation

- Able to weigh general business needs against security concerns being seen across the enterprise and industry, and articulate issues to supervisors

- Assist in incident determination, ticketing and incident response, prevention and remediation

- Recognizes successful intrusions and compromises through review and analysis of relevant event detail information.

- Translates technical vulnerabilities in business risk enabling senior leadership to make informed decision.

Knowledge and Skills Requirements:

- Under Graduate/Post Graduate Degree in Computer Science or Engineering or related domain (MCA/MTech/BTech/ BCA /BSc CS or BSc IT).

- Maintains up-to-date knowledge of the IT security industry including awareness of new or revised security solutions, improved security processes and the development of new attacks and threat vectors

- Experience in enterprise security architecture design and document creation

- Strong knowledge of enterprise incident response and forensic processes.

- Fair Understanding of Linux, TCP/IP, Network Security, encryption standards etc.

- Aware of Types of attacks (DOS, DDOS etc.)

- Digital forensics acquisition and analysis subject matter expertise

- Aware of log monitoring.

- Idea about various penetration testing and application testing methodology and tools is a definite plus.

- Knowledge in application development (Microsoft technologies).

Soft Skills:

- Excellent communication skills; written and verbal.

- Good Attitude.

- Good Presentation skills

- Good Investigative, analytical and problem solving skills.

- Ability to work in a team, with little supervision and using own initiative

8+ years experience in one or more of the following:

- Security Information & Event management (SIEM) tools.

- Incident Handling and Incident Response.

- Vulnerability assessment.

- Deep Understanding of the following: Firewalls, Intrusion detection and prevention systems, antivirus and content filtering, URL filtering, authentication solutions, switches, routers, VoIP, DMZ.

- Experience in enterprise security architecture design and document creation

- Knowledge in Linux & scripting Languages(Shell Script, VB script, Python etc) is a definite plus.

- Experience with Splunk Enterprise Security is also a plus.

Supervising Responsibilities:

- Provides coaching, guidance, assistance, and mentoring to less experienced team members within a location or department

- Helps team and colleagues understand the bigger picture of technical, ethical and financial needs .

- Requires minimal supervision from management and frequently works on projects with only periodic updates to supervisor

- May seek guidance on increasingly complex projects.

Other Requirements:

- Should be willing to work in shifts (24/7)

Certification Requirements:

- CISSP/CCFP or Associate (ISC)2 certified/qualified

- GIAC Certifications like GCIH/GCFA