Cyber Security Analyst at Agio (Raleigh, NC)

Responsibilities

• Analyze data, perform research, and verify information for potential misconduct or abnormal behavior.
• Analyze data feeds for event detection, and perform correlation analysis on data from multiple monitoring sources.
• Respond to cybersecurity events and incidents caused by internal and external threats to our clients, coordinate response activities with various stakeholders for confirmed incidents, and recommend mitigation strategies. This can involve non-traditional working hours.
• Proactively hunt for adversaries on customer networks utilizing a variety of tools and techniques
• Triage emerging threats to protect assets and information in client environments.
• Produce forensic imaging and coordinate evidence collection for investigations.
• Utilize data mining tools to collect, search, sort, and organize large amounts of information.
• Research, address, and resolve data loss prevention (DLP), virus alerts, and other security-related events.
• Partner with cross-functional technical teams to share expertise, research threats, and implement solutions.
• Produce reports, communications, e-blasts and other forms of communication that may be both internal and client facing, to include leadership and executive management.
• Draft root cause analysis reports and recommendations after cybersecurity incidents.
• Identify risk areas that will require vulnerability prevention
• Stay current with Security technologies and make recommendations for use based on business value

Requirements

• Understanding of IT operations: help desk, end-point management and server management
• 1-3 years of hands on experience with security monitoring tools such as SIEM, IDP/IDS, FW and AV
• Ability to quickly explore, examine and understand complex security problems and how it affects a customers business
• Experience with forensics, firewalls, proxies, incident response, and information security frameworks.
• Experience performing log analysis of Windows event logs, Apache, IIS, SQL, and firewall logs leveraging SIEM platforms.
• Knowledge of any of the following: AlienVault, FortiSIEM, Alert Logic, Splunk.
• Familiarity with configuring and executing vulnerability scans, leveraging tools such as Nessus and Qualys.
• Experience with system security vulnerabilities and remediation techniques.
• Strong understanding of network and web-related protocols, operating system security, common attack patterns, and exploitation techniques.
• Working UNIX/Linux knowledge
• Scripting ability in Python is a plus
• Excellent written and verbal communication skills, including presentation skills.
• Experience supporting clients and serving as a technical advisor.
• Strong analytic, qualitative, and quantitative reasoning skills.
• Knowledge of commercial and federal cybersecurity best practices preferred.
• Ability to anticipate and respond to changing priorities and operate effectively in a dynamic demand-based environment requiring flexibility and responsiveness to client matters and needs.

Qualifications/Education

• BS/BA in Information Security, Computer Science or related engineering discipline, preferred.
• 1-3 years experience in technology (security, networking, systems, etc)
• Financial services industry experience is a plus

Certifications

Certifications or work toward any of the following is strongly desired:

• GIAC Certified Incident Handler (GCIH)
• GIAC Certified Intrusion Analyst (GCIA)
• GIAC Certified Forensic Analyst (GCFA)
• GIAC Certified Forensic Examiner (GCFE)
• GIAC Network Forensic Analyst (GNFA)
• CompTIA Security+
• Industry/product specific such as EnCase Certified Examiner (EnCE)

by via developer jobs - Stack Overflow