Incident Response Analyst

Education

Bachelor’s degree in Information Technology, Computer Science, Engineering, or any related course/discipline.

Qualifications

1–2 years of experience in cybersecurity with a focus on incident response, including relevant internships. Hands-on experience with incident response tools and technologies

Duties and Responsibilities

Cyber Security Incident Response

• Actively monitor, detect, and respond to security alerts and incidents per defined SLA. • Incidents are acknowledged and responded to within the agreed response SLO
• Perform alert triage and analysis including asset and custodian identification, reputational checking, and alert validation
• Perform containment and eradication within the agreed response SLO
• Ensures resolution of incidents within the defined SLOs • Utilize IR toolsets such as ServiceNow, EAS, IPS, WAF, NAC, Firewall etc

Reports 

• Timely submission of Operational Performance reports/dashboards/value reports for consumption of management

Functional Competencies 

• Respond to cybersecurity incidents and perform containment as prescribed by available cyber security tools.
• Provide operational report and conduct turnover between shifts
• Track completion of containment action that need to stop movement of malware infection or malicious operations
• Ensure that Incident Response team is fully staffed
• Respond to cyber security incidents within SLO
• Contain cyber security incidents within SLO
• Evaluate cyber security incidents and escalate to leadership with sense of urgency
• Escalate cyber security incidents to investigation team and provide the triage report with evidences such as logs
• Timely notifications of cyber security incidents to all stake holder specially when cyber security incidents will lead to cyber crisis
• Risk and Issue management and escalation to immediate head (Supervisor and up)