This job is no longer available.
You can view related vacancies or set-up an email alert notification when similar jobs are added to the website using the buttons below.

Incident Response Team Lead

10/10/18/CR_1539157967
Up to £80000 per annum

Managing this Role

image

Charlee Ryman

Associate Consultant - Cyber Specialist 0207 759 7878

Spending seven years in the Royal Navy as a warfare technician, Charlee uses his comprehensive military network and his deep technical expertise to quickly pinpoint the best cyber security professionals for leading employers of all shapes and sizes.

 

Roles recruited: CISOs, SOCs managers/analysts and cyber security analysts/consultants

Seniority: Mid-senior

Job Type: Permanent

Geographical coverage: London

Market: Cyber security operations within MSSPs

We have partnered with a global Cyber Security Consultancy who are currently looking for an Incident Response Team Leader to compliment an already world class Incident Response team. This team respond to and contain security incidents for their clients with a particular focus on advanced targeted attacks.

Responsibilities

As a Team Lead you will focus on strategic initiatives and operational management to deliver sustainable capability improvement over time. Your key focus areas are innovation and optimisation of our services; development of junior team members; and coordination and integration with global teams.

While the role is predominantly managerial, for effectiveness it requires a strong technical background in Incident Response, and the Team Lead will be expected to be able to demonstrate experience dealing with many different types of compromises in different environments, including advanced nation state attacks.

Requirements

A deep understanding of the motivations and methods adopted by a range of threat actors with an understanding of how exploitation of systems occurs is essential. You will have experience in examining data from various sources including network traffic, volatile memory, host data, log files and other sources of information.

  • Significant industry experience as part of a CSIRT, Security Operations or Investigations team in a data regulated and mission-critical environment.
  • Experience responding to and containing live security incidents such as crimeware, data breaches and advanced targeted attacks following a standard incident handling life cycle.
  • Solid understanding of technical and security domains fundamental to investigations and incident response, including:
    • Client-server infrastructures, security architectures and related logging and alerting
    • TCP/IP networking with the ability to perform deep-dive network forensic analysis
    • File-system analysis including FAT, NTFS, HFS and/or EXT2/3/4 and ability to find and extract common disk-based indicators of compromise
    • Windows, Linux and/or OS X internals with emphasis on memory structures and ability to find common memory-based indicators of compromise
    • Malware analysis activities using behavioural techniques. Ability to perform dynamic and static analysis is an advantage
  • Ability to report key findings in a clear and concise manner both at technical and senior management level.
  • Vendor independent qualifications in Incident Response and Forensics such as SANS and CREST.

Huntress Search Ltd does not discriminate on the grounds of 'protected characteristics' as defined under the Equality Act and other relevant UK legislation.

Huntress Search Ltd acts as a Recruitment Agency in relation to all Permanent roles and as a Recruitment Business in relation to all Temporary roles.

PLEASE NOTE: We can only consider applications from candidates who have the right to work in the UK.


This job has now been filled but you may be interested in:

 

SOC Analyst - Insurance- London

We are working with a leading Insurance group who are looking to add to their Cyber Security capability in London. The SOC Analyst will work closely with the Information Security Officer, Infrastructure team and outsourced MSSP. You will have autonomy and be looked towards to help build the Cyber capability for the UK, with a look forward to building a team in the future.

Key Responsibilities

  • Monitor Security Operations Centre (SOC) generated security events and alerts
  • Perform initial analysis to determine security events and alerts requiring immediate response and escalation
  • Triage confirmed security events and alerts, in coordination with Tier 2 and Tier 3 network and infrastructure engineers, following documented procedures
  • Develop processes and response procedures to improve overall SOC functions
  • Develop, refine, maintain, and regularly test the Incident Response Plan
  • Monitor external data sources to maintain currency of information security threat condition and determine which security issues may have an impact on the enterprise
  • Maintain both internal and external vulnerability scanning tools and report on their findings

Technical Skills

  • Strong understanding of security and network incident response protocols
  • Good understanding of malware, including APT and other emerging threats
  • Strong understanding of information security principles as it relates to system, network, internet security (i.e. ports, protocols, system hardening and system functions analysis)
  • Indicators of Compromise, understanding malware analysis, VA scanners, SIEM tools
  • Sound understanding of networking administration and troubleshooting (e.g. TCP/IP, WAN/LAN and WiFi)
  • Good understanding of firewalls and IDS/IPS systems
  • Good understanding Citrix platform
  • Good understanding of Active Directory
  • Intermediate understanding of virtualization
  • Intermediate understanding of databases (SQL in particular)

Qualifications

  • Desirable qualifications for the role include CompTIA A , CompTIA A , Network , Security , Certified Ethical Hacker (CEH), GIAC, GCIH, CISSP)

Huntress Search Ltd does not discriminate on the grounds of 'protected characteristics' as defined under the Equality Act and other relevant UK legislation.

Huntress Search Ltd acts as a Recruitment Agency in relation to all Permanent roles and as a Recruitment Business in relation to all Temporary roles.

PLEASE NOTE: We can only consider applications from candidates who have the right to work in the UK.

SOC Analyst

This is your chance to take the next step into a more senior position. Working as an Integral member in my clients SOC you will be able to use SIEM tools to monitor and investigate client's security environments. You will place an emphasis on vulnerability assessments and remediation.

The role

  • Analysis and investigation of alerts from SIEM and AI tools
  • Vulnerability Scanning, reporting and prioritising
  • Utilise Intrusion Prevention solutions to monitor and alert on potential breaches.
  • Creation of custom IPS signature on occasion.
  • Use packet-capture tools
  • Use Threat Intelligence Services to identify potential new threats and develop new mitigation's.
  • Working with customer security teams to detect, contain and eradicate threats.
  • An understanding of Penetration Testing.

  • You will be Analytical, Inquisitive and have a strong passion for Cyber Security.
  • You will have the ability to lead.
  • Have a passion for self development and development of your team.

This is a good opportunity to be involved in one of the fastest growing MSSP's in Central London.

You will have the chance to test and develop your skills whilst mentoring the junior members of the team.

If this role sounds like you then go ahead and apply now.

Huntress Search Ltd does not discriminate on the grounds of 'protected characteristics' as defined under the Equality Act and other relevant UK legislation.

Huntress Search Ltd acts as a Recruitment Agency in relation to all Permanent roles and as a Recruitment Business in relation to all Temporary roles.

PLEASE NOTE: We can only consider applications from candidates who have the right to work in the UK.

Cyber Security Analyst - London

Due to a record breaking 2018, our client, a global telecommunications organisation based in London are growing their Security Operations team.

As part of this network expansion they are looking for a Cyber Security Analysts to act as Incident Handlers and will conduct vulnerability assessments and monitor systems, networks, databases and web hosted services for potential system breaches. Report, investigate and resolve security incidents. Educate and communicate security requirements and procedures to all users and new employees.

Responsibilities:

  • The post will require rotating 24X7 shift work to include daytime, night time, and weekend work
  • Act as a first line security event analyst monitoring the SIEM tools. Monitor the alarm console; provide initial analysis of logs and network traffic.
  • Provide first line telephone, e-mail and ticket routing services for security event notifications and incident response processes.
  • Deliver first level investigation and remediation activities as a member of the Security Incident Response Team. Participate in SIRT events
  • Participate in a Compliance/Vulnerability Assessment Scanning Capability.
  • Develop mitigation and remediation plans as a result of the vulnerability assessment findings.
  • Monitor threat and vulnerability news services for any relevant information that may impact installed infrastructure. Analyze reports to understand threat campaign techniques, lateral movements and extract indicators of compromise.
  • Create and update security event investigation notes, conduct shift change reports on open cases, and maintain case data in the Incident Response Management platform.

Essential & Desirable Skills:

  • Understanding of performing 1st line analysis and interpretation of information from SOC systems; incident identification/analysis, escalation procedures, and reduction of false-positives.
  • GIAC, GCIH, GIAC , GCIA
  • Intermediate knowledge of Information Security fundamentals, technologies, and design principals.
  • Understanding or proven experience in securing Windows, Linux, Oracle and VM platforms.
  • Understanding or proven experience of SIEM tools for analysing network and security incidents.
  • Experience in Tenable Network Security Nessus, BeyondTrust Retina or similar Vulnerability Assessment scanner operations for identifying network and platform risks and mis-configurations.

Huntress Search Ltd does not discriminate on the grounds of 'protected characteristics' as defined under the Equality Act and other relevant UK legislation.

Huntress Search Ltd acts as a Recruitment Agency in relation to all Permanent roles and as a Recruitment Business in relation to all Temporary roles.

PLEASE NOTE: We can only consider applications from candidates who have the right to work in the UK.