Eames are working with a reputable insurer on the hire of a Senior Security Operations Analyst. Responsibilities: Overseeing the security of the technical infrastructure provided by third-party suppliers, addressing any identified security risks to the organization. Managing the remediation of operational risks to their conclusion and taking ownership of these processes within the team. Leading the development and enhancement of detection engineering and associated technologies. Conducting operational and threat malware analysis for the organization. Offering security insights and maintaining relationships with the Service Management function concerning change management, problem management, and incident management. Handling level 2/3 operational cyber incident response. Promptly escalating any detected incidents and anomalies within the organization, providing expert guidance for operational challenges. Monitoring emerging threat patterns, vulnerabilities, and anomalies, escalating unknown threats to relevant areas within the company. Collecting metrics on the status of technical information security controls across the organization, identifying risk areas, and developing and managing remediation plans as necessary. Collaborating with all CISO teams to report and address operational issues at an architectural level. Participating in a shared, rotational 24/7 on-call requirement, acting as the single point of contact for all security-related response actions and decisions, including managing each incident from a security perspective, interacting with Incident Management/Major Incident Management teams, and recording key security decisions. Qualifications: Proficiency and experience in Firewalls, intrusion detection and prevention systems, anti-virus and content filtering, URL filtering, authentication solutions, Switches, Routers, and Voice Over IP (VoIP), as well as Firewall zoning. Ability to interpret system data, including security event logs, system logs, application logs, and device logs. Knowledge and experience with enterprise-grade technologies, including operating systems, databases, and web applications. Experience in network traffic analysis to identify developing patterns. Capability to mentor and upskill junior team members. Security analysis skills comparable to CompTIA CySA+ certification or similar. Preferred Qualifications: Experience with technologies such as Data Loss Prevention, Intrusion Prevention/Detection Systems, Firewalls, and SIEM. Knowledge of reporting suites such as Power BI. Strong understanding of Microsoft security suites and relevant qualifications. Expertise in threat identification. Security certifications such as CISM, CISSP, M.Inst.ISP, or CISA from a recognized professional body. Technical certifications in network or systems engineering from a recognized professional body. Understanding of fundamental cloud concepts, particularly for AWS. Familiarity with OWASP Top 10 and the API Security Playbook Eames Consulting is acting as an Employment Agency in relation to this vacancy.
21/05/2024
Full time
Eames are working with a reputable insurer on the hire of a Senior Security Operations Analyst. Responsibilities: Overseeing the security of the technical infrastructure provided by third-party suppliers, addressing any identified security risks to the organization. Managing the remediation of operational risks to their conclusion and taking ownership of these processes within the team. Leading the development and enhancement of detection engineering and associated technologies. Conducting operational and threat malware analysis for the organization. Offering security insights and maintaining relationships with the Service Management function concerning change management, problem management, and incident management. Handling level 2/3 operational cyber incident response. Promptly escalating any detected incidents and anomalies within the organization, providing expert guidance for operational challenges. Monitoring emerging threat patterns, vulnerabilities, and anomalies, escalating unknown threats to relevant areas within the company. Collecting metrics on the status of technical information security controls across the organization, identifying risk areas, and developing and managing remediation plans as necessary. Collaborating with all CISO teams to report and address operational issues at an architectural level. Participating in a shared, rotational 24/7 on-call requirement, acting as the single point of contact for all security-related response actions and decisions, including managing each incident from a security perspective, interacting with Incident Management/Major Incident Management teams, and recording key security decisions. Qualifications: Proficiency and experience in Firewalls, intrusion detection and prevention systems, anti-virus and content filtering, URL filtering, authentication solutions, Switches, Routers, and Voice Over IP (VoIP), as well as Firewall zoning. Ability to interpret system data, including security event logs, system logs, application logs, and device logs. Knowledge and experience with enterprise-grade technologies, including operating systems, databases, and web applications. Experience in network traffic analysis to identify developing patterns. Capability to mentor and upskill junior team members. Security analysis skills comparable to CompTIA CySA+ certification or similar. Preferred Qualifications: Experience with technologies such as Data Loss Prevention, Intrusion Prevention/Detection Systems, Firewalls, and SIEM. Knowledge of reporting suites such as Power BI. Strong understanding of Microsoft security suites and relevant qualifications. Expertise in threat identification. Security certifications such as CISM, CISSP, M.Inst.ISP, or CISA from a recognized professional body. Technical certifications in network or systems engineering from a recognized professional body. Understanding of fundamental cloud concepts, particularly for AWS. Familiarity with OWASP Top 10 and the API Security Playbook Eames Consulting is acting as an Employment Agency in relation to this vacancy.
I'm working with a Global consultancy that are looking for multiple Cyber Security Engineers specialising in SOC/SIEM to get started ASAP on a large scale programme of work for one of their Public Sector customers. These roles require an active DV Clearance. The rate is £650 Inside IR35 and is asking for 2/3 days per week on-site in either Bristol, Portsmouth or Yorkshire. This is an initial 6 month contract and is expected to last longer. Key experience required: . Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks . Skilled in maintaining Microsoft directory services. . Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) . Experience of writing Defence/Government documentation . Previous experience of Enterprise ICS/network architectures and technologies . Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. If you hold the relevant Clearance & experience and are available at short notice, please apply with a copy of your latest CV. Lawrence Harvey is acting as an Employment Business in regards to this position.
21/05/2024
Project-based
I'm working with a Global consultancy that are looking for multiple Cyber Security Engineers specialising in SOC/SIEM to get started ASAP on a large scale programme of work for one of their Public Sector customers. These roles require an active DV Clearance. The rate is £650 Inside IR35 and is asking for 2/3 days per week on-site in either Bristol, Portsmouth or Yorkshire. This is an initial 6 month contract and is expected to last longer. Key experience required: . Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks . Skilled in maintaining Microsoft directory services. . Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) . Experience of writing Defence/Government documentation . Previous experience of Enterprise ICS/network architectures and technologies . Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. If you hold the relevant Clearance & experience and are available at short notice, please apply with a copy of your latest CV. Lawrence Harvey is acting as an Employment Business in regards to this position.
We are IT Recruitment Specialists partnered with a prestigious Global Consultancy who required a Cyber Defence Engineer - Hereford Location fully onsite, the balance of time will be remote for one of their public sector Clients based in the UK. IR35: This role is inside of IR35 Initial duration: 6 months Clearance required: Must be DV cleared Role and tasks Cyber Defence Engineer Role Description: Cyber Defence Engineer will join a growing security team responsible for the testing, implementation, deployment, maintenance, configuration and troubleshooting of the SOC's technology stack (hardware and software). The engineer will also assist with the continued development and maintenance of data pipelines and signature updates and the professional development of the system engineering team. Tasks: Perform system administration on specific cyber defence applications and systems to include installation, configuration, maintenance, troubleshooting, backup and restoration. Manage system/server resources including performance, capacity, availability, serviceability, and recoverability. Diagnose and resolve customer reported system incidents, problems, and events to ensure continuing operability. Coordinate with SOC and CTI Analysts to assist in the development of signatures which can be implemented on cyber defence network tools in response to new or observed threats within the network environment or enclave. Manage the compilation, cataloguing, distribution, and retrieval of data from a range of enterprise networks and data sources. Implement data management standards, requirements, and specifications. Develop data standards, policies, and procedures. Analyse data sources to provide actionable recommendations and facilitate data-gathering methods. To share knowledge, skills and experience, create and improve documentation, and train new members of the data engineering team. Knowledge: Knowledge of big data technologies and ecosystems (eg, NiFi). Knowledge of current market and emerging leaders in data analytical and SIEM platforms. Knowledge of network security implementations (eg, host-based IDS, IPS), including their function and placement in a network. Knowledge of intrusion detection systems and signature development. Knowledge of Front End collection systems, including network traffic collection, filtering, and selection. Knowledge of system administration concepts for operating systems such as but not limited to Unix/Linux, IOS, Android, and Windows operating systems. Knowledge of cyber defence and information security policies, procedures and regulations. Knowledge of network security architecture concepts including topology, protocols, components and principles. Skills /Experience: Previous experience of Enterprise ICS/network architectures and technologies. Working with frameworks and technologies that support data-intensive distributed applications. Experience maintaining and administrating data analytical and SIEM platforms. Experience using host and network-based IDS/IPS Experience using packet capture solutions. Skill in developing and deploying signatures. Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation). Ability to provide technical and service leadership to junior SOC Engineers (mentor/coach). Desirable Qualifications/Certifications Red Hat System Administration I & II (RH124/RH134). Baseline Cyber Courses eg Cyber Foundation Pathway, SANS SEC 301 Intro to Information Security, SANS 401 Security Essentials Bootcamp. Certified engineer in a market leading data analysis/SIEM platform. SANS SEC501 Advanced Security Essentials Enterprise Defender. SANS SEC 511 Continuous Monitoring & Security Operations. SANS SEC555: SIEM with Tactical Analytics If you are interested in this position and would like to learn more, please send through your CV and we will get in touch with you as soon as possible. Please note, candidates are often Shortlisted within 48 hours.
21/05/2024
Project-based
We are IT Recruitment Specialists partnered with a prestigious Global Consultancy who required a Cyber Defence Engineer - Hereford Location fully onsite, the balance of time will be remote for one of their public sector Clients based in the UK. IR35: This role is inside of IR35 Initial duration: 6 months Clearance required: Must be DV cleared Role and tasks Cyber Defence Engineer Role Description: Cyber Defence Engineer will join a growing security team responsible for the testing, implementation, deployment, maintenance, configuration and troubleshooting of the SOC's technology stack (hardware and software). The engineer will also assist with the continued development and maintenance of data pipelines and signature updates and the professional development of the system engineering team. Tasks: Perform system administration on specific cyber defence applications and systems to include installation, configuration, maintenance, troubleshooting, backup and restoration. Manage system/server resources including performance, capacity, availability, serviceability, and recoverability. Diagnose and resolve customer reported system incidents, problems, and events to ensure continuing operability. Coordinate with SOC and CTI Analysts to assist in the development of signatures which can be implemented on cyber defence network tools in response to new or observed threats within the network environment or enclave. Manage the compilation, cataloguing, distribution, and retrieval of data from a range of enterprise networks and data sources. Implement data management standards, requirements, and specifications. Develop data standards, policies, and procedures. Analyse data sources to provide actionable recommendations and facilitate data-gathering methods. To share knowledge, skills and experience, create and improve documentation, and train new members of the data engineering team. Knowledge: Knowledge of big data technologies and ecosystems (eg, NiFi). Knowledge of current market and emerging leaders in data analytical and SIEM platforms. Knowledge of network security implementations (eg, host-based IDS, IPS), including their function and placement in a network. Knowledge of intrusion detection systems and signature development. Knowledge of Front End collection systems, including network traffic collection, filtering, and selection. Knowledge of system administration concepts for operating systems such as but not limited to Unix/Linux, IOS, Android, and Windows operating systems. Knowledge of cyber defence and information security policies, procedures and regulations. Knowledge of network security architecture concepts including topology, protocols, components and principles. Skills /Experience: Previous experience of Enterprise ICS/network architectures and technologies. Working with frameworks and technologies that support data-intensive distributed applications. Experience maintaining and administrating data analytical and SIEM platforms. Experience using host and network-based IDS/IPS Experience using packet capture solutions. Skill in developing and deploying signatures. Skill to apply cybersecurity and privacy principles to organizational requirements (relevant to confidentiality, integrity, availability, authentication, non-repudiation). Ability to provide technical and service leadership to junior SOC Engineers (mentor/coach). Desirable Qualifications/Certifications Red Hat System Administration I & II (RH124/RH134). Baseline Cyber Courses eg Cyber Foundation Pathway, SANS SEC 301 Intro to Information Security, SANS 401 Security Essentials Bootcamp. Certified engineer in a market leading data analysis/SIEM platform. SANS SEC501 Advanced Security Essentials Enterprise Defender. SANS SEC 511 Continuous Monitoring & Security Operations. SANS SEC555: SIEM with Tactical Analytics If you are interested in this position and would like to learn more, please send through your CV and we will get in touch with you as soon as possible. Please note, candidates are often Shortlisted within 48 hours.
Role Title: SIEM/Incident SME Duration: 6 months Location: Hybrid/Corsham, Portsmouth or Northallerton - 2/3 days per week at ONE site Rate: £700/d - Umbrella only PLEASE NOTE: Applicants must hold active DV Clearance to be considered for this role Would you like to join a global leader in consulting, technology services and digital transformation? Our client is at the forefront of innovation to address the entire breadth of opportunities in the evolving world of cloud, digital and platforms. Role purpose/summary The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Key Skills/requirements Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications : Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent) All profiles will be reviewed against the required skills and experience. Due to the high number of applications, we will only be able to respond to successful applicants in the first instance. We thank you for your interest and the time taken to apply!
20/05/2024
Project-based
Role Title: SIEM/Incident SME Duration: 6 months Location: Hybrid/Corsham, Portsmouth or Northallerton - 2/3 days per week at ONE site Rate: £700/d - Umbrella only PLEASE NOTE: Applicants must hold active DV Clearance to be considered for this role Would you like to join a global leader in consulting, technology services and digital transformation? Our client is at the forefront of innovation to address the entire breadth of opportunities in the evolving world of cloud, digital and platforms. Role purpose/summary The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Key Skills/requirements Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications : Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent) All profiles will be reviewed against the required skills and experience. Due to the high number of applications, we will only be able to respond to successful applicants in the first instance. We thank you for your interest and the time taken to apply!
Source Group are currently working with an International Bank in Switzerland who are looking to hire a Freelance Logging Specialist to join the Security Engineering and Architecture team. This role is only suitable to candidates based or looking to relocate to Switzerland. The perfect candidate will be an experienced Security Specialist - Logging Specialist who has extensive real-world experience with log management and SIEM solutions. This would include tools such as QRadar, Sentinel, rsyslog, Windows Event Forwarding, logstash, fluentd, etc. You would also need to be familiar with typical enterprise logging sources and log source management. The successful candidates will understand priorities and deliver tasks with minimal supervision, but also suggest improvements and nominate tasks themselves. Daily Tasks: Create parsers in QRadar. Assist with rule generation in QRadar and Sentinel. Validate log sources are logging correctly. Work with the SOC (and business areas) to ensure key devices are producing logs in compliance with policy and standards. Assist with improving the Bank's overall logging strategy. Assisting with maintenance and upgrades. Other duties as required Must Haves: Experience with log management and SIEM solutions in an enterprise environment, such as ideally with QRadar, Azure Sentinel and Windows Event Forwarding, or similar tools (Splunk, Elasticsearch, Logstash, Fluentd, Rsyslog, Syslog-ng). Experience in Cybersecurity would be ideal or System/Infrastructure loggin background could be considered. Knowledge with Linux/Unix logging (eg, syslog, journalctl, auditd). Ability to digest and understand user requirements and implement them "properly" in an existing tech stack.
20/05/2024
Project-based
Source Group are currently working with an International Bank in Switzerland who are looking to hire a Freelance Logging Specialist to join the Security Engineering and Architecture team. This role is only suitable to candidates based or looking to relocate to Switzerland. The perfect candidate will be an experienced Security Specialist - Logging Specialist who has extensive real-world experience with log management and SIEM solutions. This would include tools such as QRadar, Sentinel, rsyslog, Windows Event Forwarding, logstash, fluentd, etc. You would also need to be familiar with typical enterprise logging sources and log source management. The successful candidates will understand priorities and deliver tasks with minimal supervision, but also suggest improvements and nominate tasks themselves. Daily Tasks: Create parsers in QRadar. Assist with rule generation in QRadar and Sentinel. Validate log sources are logging correctly. Work with the SOC (and business areas) to ensure key devices are producing logs in compliance with policy and standards. Assist with improving the Bank's overall logging strategy. Assisting with maintenance and upgrades. Other duties as required Must Haves: Experience with log management and SIEM solutions in an enterprise environment, such as ideally with QRadar, Azure Sentinel and Windows Event Forwarding, or similar tools (Splunk, Elasticsearch, Logstash, Fluentd, Rsyslog, Syslog-ng). Experience in Cybersecurity would be ideal or System/Infrastructure loggin background could be considered. Knowledge with Linux/Unix logging (eg, syslog, journalctl, auditd). Ability to digest and understand user requirements and implement them "properly" in an existing tech stack.
SIEM/Incident SME CONTRACTOR MUST HOLD DV CLEARANCE Role Title: SIEM/Incident SME Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months Role Description: Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role: . Develop and integrate security event monitoring and incident management services. . Respond to security incidents as they occur as part of an incident response team. . Implement metrics and dashboards to give visibility of the Enterprise infrastructure. . Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. . Produce documentation to ensure the repeatability and standardisation of security operating procedures. . Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. . Maintain a baseline of system security according to latest threat intelligence and evolving trends. . Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. . Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. . Offer strategic and tactical security guidance including valuation requirement of technical controls. . Be part of the CRM process . Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. . Document, validate and create operational processes and procedures to help develop the SOC. . Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. . Build, install, configure, and test dedicated cyber defence hardware. . Support Junior Analysts to manage SOC systems. . Previous experience of Enterprise ICS/network architectures and technologies . Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. . Experience as a mentor/coach to Junior Analysts Your profile: . Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks . Skilled in maintaining Microsoft directory services. . Skilled in using virtualisation software. . Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) . Excellent communication skills . Experience of writing Defence/Government documentation Desirable Qualifications: . Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) . SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) . Advanced Analyst Course (SANS SEC503 or equivalent) If this role is of interest to you, and you hold an active DV clearance - please apply now! Carbon60, Lorien & SRG - The Impellam Group STEM Portfolio are acting as an Employment Business in relation to this vacancy.
20/05/2024
Project-based
SIEM/Incident SME CONTRACTOR MUST HOLD DV CLEARANCE Role Title: SIEM/Incident SME Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months Role Description: Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role: . Develop and integrate security event monitoring and incident management services. . Respond to security incidents as they occur as part of an incident response team. . Implement metrics and dashboards to give visibility of the Enterprise infrastructure. . Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. . Produce documentation to ensure the repeatability and standardisation of security operating procedures. . Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. . Maintain a baseline of system security according to latest threat intelligence and evolving trends. . Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. . Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. . Offer strategic and tactical security guidance including valuation requirement of technical controls. . Be part of the CRM process . Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. . Document, validate and create operational processes and procedures to help develop the SOC. . Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. . Build, install, configure, and test dedicated cyber defence hardware. . Support Junior Analysts to manage SOC systems. . Previous experience of Enterprise ICS/network architectures and technologies . Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. . Experience as a mentor/coach to Junior Analysts Your profile: . Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks . Skilled in maintaining Microsoft directory services. . Skilled in using virtualisation software. . Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) . Excellent communication skills . Experience of writing Defence/Government documentation Desirable Qualifications: . Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) . SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) . Advanced Analyst Course (SANS SEC503 or equivalent) If this role is of interest to you, and you hold an active DV clearance - please apply now! Carbon60, Lorien & SRG - The Impellam Group STEM Portfolio are acting as an Employment Business in relation to this vacancy.
SIEM/Incident SME Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months MUST BE PAYE THROUGH UMBRELLA We are heading up a recruitment drive for a global consultancy that require a DV Cleared SIEM/Incident SME to join them on a major project that's based onsite 4/5 days in either Warwick, Farnborough or Corsham. Role Description : Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Your profile Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications: Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent)
20/05/2024
Project-based
SIEM/Incident SME Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months MUST BE PAYE THROUGH UMBRELLA We are heading up a recruitment drive for a global consultancy that require a DV Cleared SIEM/Incident SME to join them on a major project that's based onsite 4/5 days in either Warwick, Farnborough or Corsham. Role Description : Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Your profile Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications: Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent)
We are Global IT Recruitment specialist that provides support to the clients across UK, Europe and Australia. We have an excellent job opportunity for you. Role Title: SIEM/Incident SME (Need Active DV Clearance) Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months Role Description: Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Your profile Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications: Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent)
17/05/2024
Project-based
We are Global IT Recruitment specialist that provides support to the clients across UK, Europe and Australia. We have an excellent job opportunity for you. Role Title: SIEM/Incident SME (Need Active DV Clearance) Location: Hybrid onsite in one of the following locations 2/3 days per week - Corsham, Portsmouth or Northallerton Duration: 6 months Role Description: Main Tech Skills required are ELK (Elastic, Logstash, Kibana) and Tanium The Cyber role is to join a growing security team responsible for designing, delivering and maintaining operational cybersecurity capabilities. Conducting pro-active, risk-based, protective monitoring on priority C4IS/networks to identify internal and external cyber-threats/attacks. This position involves a broad range of skills, including the development and mentoring of Junior Analysts, monitoring networks to actively remediate unauthorised activities. Your role Develop and integrate security event monitoring and incident management services. Respond to security incidents as they occur as part of an incident response team. Implement metrics and dashboards to give visibility of the Enterprise infrastructure. Use of the SOAR platform to assist with playbook automation and case management capabilities to streamline team processes and tools. Produce documentation to ensure the repeatability and standardisation of security operating procedures. Develop additional investigative methods using the SOC's software toolsets to enhance recognition opportunities for specific analysis. Maintain a baseline of system security according to latest threat intelligence and evolving trends. Participate in root cause analysis of incidents in conjunction with engineers across the enterprise. Provide Subject Matter Expertise (SME) on a broad range of information security standards and best practices. Offer strategic and tactical security guidance including valuation requirement of technical controls. Be part of the CRM process Liaise with the SOC engineers to maintain up-to-date dashboards of security alerts, to allow the organisation to better respond to an incident. Document, validate and create operational processes and procedures to help develop the SOC. Assist in identifying, prioritising, and coordinating the protection of critical cyber defence infrastructure and key resources. Build, install, configure, and test dedicated cyber defence hardware. Support Junior Analysts to manage SOC systems. Previous experience of Enterprise ICS/network architectures and technologies Experience and knowledge of SIEM solutions; having the ability to identify use cases and their creation, their deployment and tuning. Experience as a mentor/coach to Junior Analysts Your profile Previous experience of utilising the MITRE ATT&CK and Cyber Kill Chain frameworks Skilled in maintaining Microsoft directory services. Skilled in using virtualisation software. Knowledge of key security frameworks (eg ISO, NIST 800-53, 800-171, 800-172, C2M2) Excellent communication skills Experience of writing Defence/Government documentation Desirable Qualifications: Broad Spectrum Cyber Course (SANS SEC401 or SEC501 or equivalent) SIEM Design, Architecture and Analyst Course (SANS SEC455 or SEC555 or equivalent) Advanced Analyst Course (SANS SEC503 or equivalent)