AAS-C001582 -Snr Security Event Analyst (NS), Mons - FRI 23rd JULY

Conteúdo do emprego

• Conduct detailed investigation and research of security events within NATO Cyber Security Centre (NCSC) team
• Analyze firewall, IDS, anti-virus and other network sensor produced system security events and present findings
• Provide detailed technical reports about incidents and capability improvements
• Share security event/incident information with stakeholders via presentations and technical reports
• Appropriatelyleverage the comprehensive extended toolset(e.g. Log Collection, Intrusion Detection, Packet Capture, VA, Network Devices etc) to identify malicious activity.
• Be able to recommend improvements to enable enhancing investigations
• Provide Subject Matter Expertisesupporting the end-to-end Cyber Security Incident Handling process
• Propose possibleoptimisations and enhancement which help to both maintain and improve NATO’s Cyber Security posture
• Conducttechnical reports and presentations regarding area of responsibility.

• Required Security Clearance NATO Secret
• A university degree at a nationally recognised/certified University in a technical subject with substantial Information Technology (IT) content and 4 years of specific experience.
• Exceptionally, the lack of a university degree may be compensated by the demonstration of a candidate’s particular abilities or experience that is/are of interest to NCI Agency; that is, at least 7 years extensive and progressive expertise in the duties related to the function of the post.
• Expert level in at least three of the following areas and a high level of experience in several of the other areas;
• Security Incidents Event Management products (SIEM) – e.g. Splunk,
• Network Based Intrusion Detection Systems (NIDS) – e.g. SourceFire, Palo Alto Network Threat Prevention
• Host Based Intrusion Detection Systems (HIDS)
• Full Packet Capture systems – e.g. Niksun, RSA/NetWitness,
• A variety of Security Event generating sources (e.g. Firewalls, IDS, Routers, Security Appliances)
• Computer forensics tools (stand alone, online and network)
• Computer incident response centre (CIRT), computer emergency response team (CERT)
• Computer security tools (Vulnerability Assessment, Anti-virus, Protocol Analysis, Anti-Virus, Protocol Analysis, Anti-Spyware, etc)
• Proficiency in Intrusion/Incident Detection and Handling,
• Comprehensive knowledge of the principles of computer and communications security, networking, and the vulnerabilities of modern operating systems and applications.
• Desirable
• Industry leading certification in the area of Cybersecurity such as GCIA, GNFA, GCIH.
• Solid knowledge and experience in Splunk Enterprise Security suite.
• A good understanding of Security, Orchestrations, Automation and Response (SOAR) concepts and their benefits to the protection of CIS infrastructures.
• Solid knowledge and experience in monitoring threats in a cloud environment
• A solid understanding of Information Security Practices; relating to the Confidentiality, Integrity and Availability of information (CIA triad.)