Cyber Shift Analyst

Open to Internal DCC Applications Only until Friday 8 th
December 5pm.Working Onsite Rotating Shifts – ManchesterThe Role This role will be integral to our approach to Security Response at SmartDCC, assisting with the toolsets, processes and capabilities required to effectively deliver a world class security operations Centre. Responsibilities will include managing security investigations that are initiated by managed security services (SOC) or from events generated by our security tools. Along with being part of our response team on more significant incidents.
The role will be focused on leveraging the technology and capabilities we have deployed to fine tune
alerting, and to carry out security investigations, engaging with other DCC teams and Service Providers to resolve incidents.
You will be joining an exciting and growing area and will be instrumental in supporting and advancing the operational security capabilities of the Cyber Security Team. There will be opportunity to work on and establish new Security Projects, as well as provide an advisory role to other elements of the business on best practice.
The role will require establishing relationships with key stakeholders in Risk, Technology and Operations, as well as establishing yourself as a SME for cyber security within the organisation.
What Will You Do
· Analysis and Incident Investigation Senior, ensuring threats escalated to the security team are
appropriately assessed and investigated.
· Primary point of contact for our Cyber security Manager, ensuring alerts raised to the Security team
are followed through and investigated.
· Identify opportunities for security improvements and work with relevant infrastructure teams to
· Assist in the Develop of operational metrics and dashboard reporting for operational security
posture.
· Support operational security projects and where necessary attend Technical Design Forms and
represent the Cyber Security team at Change Control.
· Reviewing products that can advance our security capabilities, such as tools that support
analysis, to detection capabilities and other emerging technologies.
What You Will Have
· Provide guidance to SOC analysts, including apprentices and cyber security analysts.
· Good communication and presentation skills, translating technical content to wide range of stakeholders and reporting findings senior leadership.
· Ability to work independently to delivery against personal and team objectives, liaising with
relevant teams.
· Good network knowledge and principles; LAN, TCP/IP, OSI Model, DNS, DHCP, Wi-Fi, Routing,
· Understanding of key windows domain services, such as Active Directory, Exchange and Windows
· Experience in applying security best practices to end user devices (workstations) and
· Exposure to key security technologies, such as IDS, Web content filters, AV, SIEM, Vulnerability
Management, Firewalls, and awareness of their purpose in a layered security approach
· Good cloud knowledge – Azure and AWS
· Experienced in the use of Elastic Search
· Experience and understanding of ITIL
· In depth knowledge of the Mitre Att&ck framework
· 3 years plus security incident management experience.
The individual is expected to be able to convey impact and translate technical findings or information to a broad audience, from senior stakeholders to technical individuals that need to understand the detail.
· It is important therefore that the role holder can tailor communication and information for a specific audience.
· The successful candidate must have the ability to be cleared to HMG SC clearance level
Special Requirements
To have open recruitment and recognizing the diverse nature of experience and expertise that can be suitable for this role, all points listed here are optional, but examples useful experience or skills that will be applicable in the role. Noting that additional training will be provided to bridge any gaps in knowledge.
· Expertise/working knowledge of one or more key security technologies such as IDS, SIEM,
Vulnerability Management.
· GIAC Qualifications (GCIA, GCIH, GCFA, GREM)
· Experience with Linux Server and Desktop environments (CentOS, Ubuntu, Amazon)
· Knowledge of the Mitre Att&ck framework, and application in incident investigation.
· Programming or Scripting experience, either in Web Technologies or PowerShell/Perl/Python.
#J-18808-Ljbffr