Incident Response and threat intelligence specialist

Job Summary

This position is an experienced, senior level, hands-on technical lead, performing cyber security incident response functions and maintaining systems, while providing technical guidance to the team.  Reporting to the Security Ops and Incident Response lead. The Incident Response and threat intelligence specialist will be responsible for incident response and proactive cyber threat hunting. This role will be responsible to conduct in-depth investigations, contextualize incidents with PSEG Long Island-internal information, and drive containment and response actions with PSEG IT teams. Will provide technical leadership and direction during the duration of a security incident, leveraging all available detection and response tool suites within PSEG, including SIEM, EDR/XDR, email security, DNS filtering, and network security appliances, to analyze malicious artifacts and assist with forensic investigations.

Job Responsibilities

Responsibilities include:
-    Responds to and remediates email, endpoint, threat intelligence, and network-based threats; provides forensic investigation and support
-    Provides after-hours support as needed for response activities
-    Collaborates with cross divisional and Cybersecurity teams to continuously improve security capabilities and response to threats in the most efficient and effective manner
-    Assists with projects to implement advanced technologies to prevent & identify malicious behavior within cloud environments, networks, endpoints, and email technologies
-    Operates products such as SIEM, SOAR, threat intelligence platforms, advanced email protection, EDR, cloud security products, IDS/IPS, , and other security technologies
-    Implements and performs threat analysis utilizing industry standard frameworks (kill chain/diamond model) and techniques
-    Proposes and helps review security plans and policies to improve environmental security
-    Maintains and produces metrics, operational playbooks, process diagrams and documentation for the Cybersecurity program
-    Produces and distributes operational and tactical threat intelligence reports
-    Other duties may be assigned as needed to address new security threats facing the enterprise
-    Assists in the investigation and resolution of security events and incidents
-    Perform security event correlation, triage, and analysis
-    Apply security Threat Intelligence while responding to and investigating security events or Incidents
-    Develop Self and/or Others: Planning and supporting the development of knowledge, skills, and abilities to fulfil current or future job responsibilities more effectively
-    Champion Change: Actively engaging and supporting change and innovation by communicating the future-state, trying new approaches, and collaborating with others to make the change successful
-    Build Relationships: Building, leveraging, and maintaining relationships within and across work groups. 
-    Leads and manages information security technologies
-    Provides technical expertise in threat/risk assessments
-    Defines, designs, and implements strategies to protect against emerging threats using security tools
-    Responds to security incidents
-    Performs security reviews on new technologies and changes to existing technologies
 

Job Specific Qualifications

Required Qualifications:

•    Bachelors degree and 6 years of relevant cyber security experience
•    In lieu of a degree 10 years of cyber experience
•    Experience leveraging information security technologies such as antivirus, IDS/IPS, SIEM, endpoint detection & response, DLP, data encryption, proxies, and network access control as it relates to responding to cyber incidents.
•    Ability to provide technical expertise and support to clients, IT management and staff in cybersecurity threat risk assessments, development, testing and the implementation and operation of appropriate information security plans, procedures, and control techniques designed to prevent, minimize or quickly recover from cyber-attacks or other serious events.
•    Must demonstrate strong incident response and threat analysis experience, including leveraging SIEM technology.  
•    Experience in defining processes and procedures for incident response.  
•    Demonstrated ability to follow cyber security news and alerts in order to understand complex attack vectors and risks including the ability to identify and evaluate emergent cyber security threats and vulnerabilities. 
•    
•    Broad knowledge of information systems including Windows security, network security, systems development, communication networks, security software/hardware and operating systems.
•    Experience with key information security technologies such as SIEM, firewalls, intrusion detection/prevention systems, vulnerability assessment, encryption, identity and access control systems, anti-malware, and security event analysis
•    Experience with cloud computing and can implement strong security to protect cloud environment.
•    Experience designing process flows to be implemented in security automation tools to automatically respond to threats quickly and effectively.
•    Must be able to work independently with little or no supervision.
•    Experience working in a team environment, with experience teaching and learning from other team members.
•    Ability to foster working relationships with the team, IT Management and Client departments.
•    Ability to explain technical concepts to the business users in the context of business requirements.
•    Experience leading, organizing, and resolving responses to cyber incidents.
•    Experience communicating effectively with both technical and non-technical individuals.

Desired Qualifications:
•    Industry Security certifications such as SANS, CISSP, etc.