Job Description
Cyber Incident Response Lead - Advanced Response Team (Remote)Experian is committed to helping you protect, understand, and improve your credit. Experian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare, create marketing solutions, and gain deeper insights into the automotive market, all using our unique combination of data, analytics, and software. We also assist millions of people to realize their financial goals and help them save time and money.We operate across a range of markets, from financial services to healthcare, automotive, agribusiness, insurance, and many more industry segments.We invest in people and new advanced technologies to unlock the power of data. As a FTSE 100 Index company listed on the London Stock Exchange (EXPN), we have a team of 22,500 people across 32 countries. Our corporate headquarters are in Dublin, Ireland.Job DescriptionAs a member of Experian's Global Security Office (EGSO)/Cyber Fusion Center (CFC), you will respond, contain, escalate, investigate, and coordinate mitigation of security events relative to anomalies detected and escalated by the Cyber Fusion Center according to Experian's Incident Response Plan. As an individual contributor, this team member will join a new, growing team of specialized, advanced responders to support escalations of complex and prioritized matters from Experian's existing 24x7 security monitoring and response functions, responsible for responding to and analyzing security incidents involving threats targeting Experian information assets. You will work with end-users, technical support teams, and management to ensure remediation and recovery from these threats.You will report to the CFC Senior Director of Incident Management and Security Operations.You'll have the opportunity to:Conduct advanced incident response activities to investigate and contain complex or larger-scale cybersecurity mattersOrchestrate workstreams across teams (Forensics and Cyber Threat Hunting) and hold responsibility for explaining the CFC's overall understanding of the timeline of attacker activity so that appropriate containment and remediation actions can be coordinatedRespond to cyber security events and alerts associated with threats, intrusions, or compromises per any applicable SLOsManage multiple cases related to security incidents throughout the incident response lifecycle, including Analysis, Containment, Eradication, Recovery, and Lessons LearnedCoordinate successful conclusion of security incidents according to Process & Procedures, and escalate severe incidents according to Experian's Incident Response PlanMaintain case documentation, including notes, analysis findings, containment steps, and cause for each assigned security incidentMaintain assigned caseload and move incidents through each phase of the IR Lifecycle, handing off cases as needed for progressMaintain an understanding of common Operating Systems (Windows, Linux, Mac OS), Security Technologies (Anti-Virus, Intrusion Prevention), and Networking (Firewalls, Proxies)Interpret device and application logs from a variety of sources (Firewalls, Proxies, Web Servers, System Logs, Splunk, Packet Captures) to identify the root cause and determine the next steps for containment, eradication, and recoveryMentor and provide advanced support to analysts (Logs review, IP Block question)Support overall direction for the CFC and input to the security strategyQualificationsYour background:Bachelor's Degree in Computer Science, Computer Engineering, Information Security, or a related field, or 8+ years of experience working within Security Operations Centers or Cyber Security Incident Response TeamsDemonstrated knowledge of Incident Response and Investigative MethodologyMust have knowledge of network protocols (TCP/IP, UDP, ICMP), standard protocols (HTTP/S, DNS, SSH, SMTP, SMB), wireless networking, networking infrastructure, and network topologies (DMZ, VPN, WAN) and network technologies (WAF, IPS, Routers, Firewalls)Experience with commercial and open-source SIEMs, full packet capture tools, and network analysis tools (Splunk, Wireshark, SOF-ELK)Exhibit skills using common Incident Response and Security Monitoring applications such as SIEM (Splunk), EDR (FireEye HX, CrowdStrike Falcon, McAfee mVision EDR), WAF, IPSDemonstrated knowledge of common intrusion methods and cyber-attack tactics, techniques, and procedures (TTPs)Must have at least one certification involving incident response, ethical hacking, cyber security (GCIH, E|CEH, E|CIH), or network forensics (GIAC Network Forensic Analyst (GNFA), NICCS Certified Network Forensics Examiner (CNFE))Currently hold one Security Management certification (ISC2 CISSP, CISM) or obtain such certification within the first two years as a Cyber Incident Response Team LeadThis role has a regular Monday – Friday schedule, with the candidate expected to participate in an on-call schedule or work outside of normal work hours when required to respond to cybersecurity incidentsAdditional InformationExperian is proud to be an Equal Opportunity and Affirmative Action employer. Innovation is an important part of Experian's DNA and practices, and our diverse workforce drives our success. Everyone can succeed at Experian and bring their whole self to work, irrespective of their gender, ethnicity, religion, colour, sexuality, physical ability, or age. If you have a disability or special need that requires accommodation, please let us know at the earliest opportunity. #J-18808-Ljbffr