Analyst Cyber Security Operations

REQ14047 Analyst, Cyber Security Operations (Open)

Position Summary

The Analyst, Cyber Security Operations executes daily operations procedures as part of their daily task and responsibility.

He / she conducts the detailed and repeatable execution of all security operational tasks as described in the Cyber Security Operations Center processes, procedures and playbook.

He / she will be responsible for monitoring the Security Operations Center Main Channel for security events and responding accordingly.

He / she will maintain the group email address and distribution lists, answers to Security Operations Center main phone lines, and update all relevant documentation such as shift logs and tickets.

Primary Responsibilities

• Rapidly identifies, categorizes, prioritizes and investigates events as the initial cyber event detection group for Melco group utilizing all available Security Operations Center log sources to include but not limited to:
• a. Firewalls
• b. Systems and Network Devices
• c. Web Proxies
• d. Intrusion Detection/Prevention Systems
• e. Antivirus Systems
• Monitors incoming event queues and active channels for security incidents using SIEM Tool per operational procedures.
• Performs initial investigation, triage of potential incidents, and responds accordingly.
• Uses available Cyber Security Operations Center tools for historical analysis purposes as necessary for detected events.
• Monitors ticket or emails queue for potential event reported from outside entities and users.
• Maintains Security Operations Center shift logs with relevant activity from shift.
• Documents investigation results, and ensures relevant details are passed to Level 2 for further analysis and action.
• Updates and references Security Operations Center collaboration tool as necessary for changes to Security Operations Center process and procedure, and ingest of Security Operations Center daily intelligence reports and previous shift logs.
• Conducts security research and intelligence gathering of emerging threats and exploits.
• Performs additional auxiliary responsibilities as outlined in the Console Monitoring Procedure.
• Serves as a backup analyst for any potential coverage gaps to ensure business continuity.
  
  

• Understanding of TCP/IP, UDP, DNS, FTP, NetBIOS, and other protocols.
• Understanding of network analysis, net flow analysis and use network sniffing tools
• Understanding of log analysis tools (Log Logic, Splunk, or similar)
• Understanding of Linux, UNIX, Windows
• Understanding or experience with Security Event Information Management tools
• Understanding of exploits and vulnerabilities
• Understanding of the incident response processes or phases
• Understanding of malware and eradication
• Understanding of basic network services, vulnerabilities and attack surface.
• Capacity to work independently and in a team environment, with proven leadership ability and project management skills
• Must have excellent analytical skills, have the ability to multi-task and have solid project management skills.
• Ability to understand the relationship between business processes, priorities, risk and their underlying technologies and security risks
• Ability to keep pace with a fast pace and growing company
• Ability to maintain discretion
  
  

• Analytical and detail oriented – individuals must have passion and initiative
• Strong written and verbal communication skills, good listening and presentation skills.
• Independent-thinker and self-starter, who still can work well within team environment
• Follow-up and attention to detail with great customer service skills.
• Displays a high commitment to delivering results
• Works well with others
• Achieves agreed objectives and accepts accountability for results
• Displays the highest level of integrity