Cybersecurity Analyst -SOC L3

This role will assist with the implementation and operation of cybersecurity practices to ensure reliability, resilience and compliance to protect SI against external and internal threats.

Cyber operations

• Monitor threat landscape for emerging threats and facilitate threat intelligence to the working group and stakeholders;
• Monitor the internal Cyber incident ticketing system and action appropriately within the agreed SLA's;
• Enhance the efficiency of the service delivery by automating repetitive tasks;
• Manage and enhance various Security Technologies in collaboration with other teams, SI SOC Service and Cybersecurity Managed Service Providers;
• Measure and improve Key Performance Indicators for Cybersecurity Operations and Posture;
• Measure and improve Cybersecurity vendors against SLA's, KPI's - manage performance as required;
• Facilitate and assist with Reporting for Security Operations, cybersecurity posture maturity and policy compliance;
• Assist in Administration, reporting and configuration of the SI Privileged Access Solution;

Incident Management:

• Coordinate the organisation's incident response activities, ensuring swift and effective incident resolution in accordance with SI and global SOC response procedures;
• Monitor security alerts and incidents to identify potential threats, vulnerabilities, and indicators of compromise;
• Perform in-depth analysis of security incidents, including the identification and containment of threats, and recommend appropriate response actions;
• Conduct detailed forensic analysis and investigations to determine the root cause and impact of security incidents;
• Develop and maintain incident response playbooks, standard operating procedures, and communication protocols.

Incident Mitigation and Recovery

• Execute timely and effective containment, eradication, and recovery activities in response to security incidents.
• Coordinate with IT teams to isolate affected systems, patch vulnerabilities, and implement corrective actions.
• Assist in system and network hardening activities to improve the overall security posture of the organization.
• Support business continuity, disaster recovery and Cyber Incident Response Plans to ensure resilience in the event of a security incident.
• Participate in Table Top and Lessons Learnt exercises to help improve BCP/DR and Cyber Incident Response Plans.

Incident Reporting and Documentation

• Support preparation of accurate and detailed incident reports, including the description of events, actions taken, and lessons learned in collaboration with Sime SOC service;
• Maintain comprehensive documentation of incident response activities, including evidence collection and preservation where this isn't prepared by the Sime SOC service;
• Collaborate with compliance team to ensure any SIEM logging requirements, SIEM Use cases and incident reporting obligations are met.
• Work with Manager for Cybersecurity, GRC, and other incident response stakeholders to contribute to the Cyber Incident Response Plan (CIRP) and playbooks.
• As a major stakeholder in Incident response and escalation, your contribution to the testing and continual improvement of the Cyber Incident Response plan is a major part of its success.
• From regular SOC incidents and reporting, discover and document common threat types and trends, and eliminate root causes where possible.

Threat Detection and Analysis

• Utilise security monitoring tools and technologies to identify potential security incidents and breaches;
• Perform proactive threat hunting activities to detect advanced threats and vulnerabilities in the environment;
• Conduct analysis of security events and logs to identify patterns, trends, and emerging threats;
• Collaborate with threat intelligence teams to incorporate external intelligence into detection and response strategies.

Vulnerability Management

• Operate and improve vulnerability management solution in collaboration with Managed Service Provider;
• Collaborate with system and product owners on prioritising and remediating vulnerabilities;
• Assist with implementation of technical and risk reducing controls against group Risk Appetite with the goal of reducing Mean-Time-To-Remediation for vulnerabilities present or exploitable in the IT ecosystem.