Purpose of the Job:
The Lead Cyber Security Engineer – Cyber Defense is responsible for designing,
fixing and maintaining tools and processes to ensure fast and flawless cyber
security threat detection, investigation and response along with keeping systems
related to cyber operations up-to-date and effective. Their primary
responsibilities will be integrating new vendors/tools with SIEM,
troubleshooting SIEM-related technology stack, onboarding new log sources,
leading projects for new initiatives, architecting new and existing designs,
keeping SIEM-related content and configurations up-to-date and working with
security engineering team to make sure that detection capabilities are tuned and
enabled. They will also automate processes related to security operations to
increase effectiveness of detection and response.
\n
Main Activities:
- Perform the day-to-day engineering responsibilities related to threat
detection and response including threat intelligence, security event
correlation (SIEM), security monitoring, security analytics (UEBA), threat
hunting, security investigations and security incident response
- Continuously monitor health alerts and events of various systems related to
SIEM and Cyber Defense Centre tools/vendors
- Lead the engineering for cyber security, including but not limited to SIEM
for updates, configurations, maintenance and troubleshooting
- Investigate and fix broken processes, automations, connectors, automations
either individually or collaborating with other teams to mitigate the impact
to the security operations
- Provide post-troubleshoot and post-maintenance reports and lessons learned to
improve cyber engineering efforts
- Maintain documentation of operational procedures and similar references,
including cyber engineering, log onboarding, troubleshooting, architectural
designs etc.
- Collaborate with external partners, vendors, government agencies, and private
organizations to stay ahead of emerging updates, migrations, changes and
configurations to keep the systems effective and up to date
- Provide input to the strategic designs and architectures regarding cyber
defense operations, plans and roadmaps for all engineering functions.
- Provide technical expertise and technology investment recommendations for new
technologies and systems.
- Lead and contribute to the planning and execution of projects to build and/or
improve threat detection and response capabilities.
- Design and implement automation needs required by cyber defense operations
- Design and implement dashboards, reports, monitoring needed in Sentinel
workbooks
- Monitor and respond to onboarding requests from internal teams required by
compliance/risk purposes
- Provide support and evidence for requirements for internal/external audit
requests
- On call, off-hours and/or shift work will be required.
- Stay current on the cyber security threat landscape, including the latest
attacker tactics, techniques and procedures, and the controls that may serve
as effective countermeasures.
- Practice continual improvement for cyber defense practices, and participate
in activities to identify improvements, including internal measurement
practices, security practice reviews and internal/external audits.
Knowledge/Skill Requirements:
- Training/degree/diploma/certificate in Computer Science, Cyber
Security/Engineering or related field
- A minimum six (6) years in an information/cyber security engineering role
- SANS SEC511 or SEC530, Microsoft AZ-500 or AZ-305, ISC2 SSCP or similar
certification is preferred
- Extensive experience in Azure logic app design and configurations
- Extensive experience in Microsoft Sentinel KQL
- Extensive technical expertise in Azure services and portals such as Defender
for Cloud, Defender for Endpoint, Defender for Identity, Defender for Cloud
Apps and Defender for IoT, Sentinel, Log Analytic Workspace, Azure
monitoring, Data Collection Rules, Azure Entra ID, Azure policies, Enterprise
apps and registrations
- Ability to code in python
- Ability to work in a fast-paced environment with minimal guidance and
supervision.
- Experience in at least two of the following disciplines in terms of security
engineering: threat intelligence, security event correlation (SIEM), security
monitoring, threat hunting, security analytics (UEBA), security
investigations and security incident response.
- Ability to adapt to constantly changing technical, regulatory, and compliance
environments.
- The incumbent is expected to interact with all employees including executives
and thus good verbal and written skills are important.
- Experience working in a banking or financial services environment is an asset
- Strong technical background in encryption technologies, network communication
protocols (SMTP, DNS, HTTP/s and IP), and Azure services (Sentinel,
diagnostics, storage accounts and identities)
- Ability to think out of the box for solutions to technical problems
- Experienced in NIST CSF, Mitre Att@ck and Cyber Kill Chain
- Ability to work independently without the need for direction from supervisors
or other managers in the projects and technical configurations
- Ability to manage, deploy and configure Linux systems and trouble shoot
issues on Linux systems
\n
