Cyber Incident Response Analyst 4
Posted 3 days ago by Randstad Digital
Negotiable
Undetermined
Remote
Remote or Boston, Massachusetts
Summary: The Cyber Incident Response Analyst 4 is responsible for monitoring and analyzing security events to identify potential threats, leading incident management from triage to resolution, and developing threat detection policies. This role requires collaboration with cross-functional teams to conduct root cause analysis and improve the organization's security posture. The analyst will also manage threat intelligence data and maintain incident response plans to adapt to evolving threats.
Key Responsibilities:
- Monitor and analyze network, host, cloud posture, identity, attack surface, intelligence, and email based security events and logs to identify potential security threats.
- Prioritize and differentiate between potential intrusion attempts, false alarms, and risks.
- Properly respond to alerts that require incident response review.
- Develop and tune threat detection policies, rules, and intelligence.
- Lead the management of complex information security incidents from triage through resolution.
- Manage multiple investigations concurrently.
- Lead a cross-functional team of experts to resolve the incident investigation.
- Provide timely and relevant updates to appropriate stakeholders and decision makers.
- Conduct root cause analysis and partner with functional experts to determine the remediation path for incident resolution.
- Provide findings to relevant business leadership to help improve information security posture.
- Validate and maintain incident response plan and playbooks to address the evolving threat landscape.
- Create and maintain strong relationships with key partners in the incident response ecosystem.
- Compile and analyze data for management reporting and metrics.
- Provide rotational on-call support for assessing potentially critical alerts escalated by off-hours monitoring team.
- Manage and analyze threat intelligence data received from cyber threat vendors.
- Monitor information security related websites and mailing lists to stay current on the latest malicious code trends, exploits, and malware.
- Participate in working groups that assess Iron Mountain's risk posture.
- Analyze the potential impact of new threats and communicate risks to relevant business units.
- Develop advanced threat detection rules based on analysis of intelligence.
Key Skills:
- Ten or more years of technical experience in the information security field, preferably in a Security Operations Center (SOC), Network Operations Center (NOC), or Computer Emergency/Incident Response Team (CERT/CIRT).
- Eight or more years of practical Cyber Incident Management and Threat Hunting experience.
- Advanced knowledge of information systems security concepts and technologies, including SIEM technologies, network architecture, database concepts, intrusion detection, cloud security, endpoint detection and response (EDR), email protection, malware remediation, and computer forensic tools.
- Familiarity with security frameworks, such as NIST, and compliance standards such as HIPAA, GDPR, PCI, and FedRAMP.
- Strong understanding of incident, problem, and change management is preferred.
- Advanced knowledge and experience with the Windows and Linux operating systems.
- Working knowledge and experience with investigating malicious code.
- Demonstrated ability to apply technical and analytical skills in a security environment.
- Ability to work extremely well under pressure while maintaining a professional image and approach.
- Exceptional data analytics abilities; can perform independent analysis and distill relevant findings and root cause.
- Strong analytical writing skills; can articulate complex ideas clearly and effectively.
- Team player with proven ability to work effectively with other business units, IT management and staff, Legal, vendors, and consultants.
- Strong communication skills; can plan and lead effective meetings, conduct structured interviews, and present to a variety of audiences.
- Experience in tools such as Chronicle Backstory, Crowdstrike Falcon, Prisma Cloud, Check Point Next Generation Appliances, Tenable, Tanium, Google Cloud Platform, AWS, Azure.
- Working understanding of threat intelligence, SOAR, and attack surface platforms.
Salary (Rate): £61.00 hourly
City: Remote
Country: undetermined
Working Arrangements: remote
IR35 Status: undetermined
Seniority Level: undetermined
Industry: IT
Security Alert Management/Threat Hunting
Monitor and analyze network, host, cloud posture, identity, attack surface, intelligence, and email based security events and logs to identify potential security threats.
Prioritize and differentiate between potential intrusion attempts, false alarms, and risks.
Properly respond to alerts that require incident response review.
Develop and tune threat detection policies, rules, and intelligence.
Incident Response
Lead the management of complex information security incidents from triage through resolution.
Ability to manage multiple investigations concurrently.
Lead a cross-functional team of experts to resolve the incident investigation.
Provide timely and relevant updates to appropriate stakeholders and decision makers.
Conduct root cause analysis and partner with functional experts to determine the remediation path for incident resolution. Root cause analysis may include, but is not limited to malware analysis, computer forensic analysis, log analysis, personnel interviews, and technical troubleshooting. The CIRT Analyst IV will evaluate controls at each level of security defense, from end-point to perimeter.
Provide findings to relevant business leadership to help improve information security posture.
Validate and maintain incident response plan and playbooks to address the evolving threat landscape.
Create and maintain strong relationships with key partners in the incident response ecosystem and ensure efficient alignment during the investigation process.
Compile and analyze data for management reporting and metrics.
Provide rotational on-call support for assessing potentially critical alerts escalated by off-hours monitoring team.
Threat Management
Manage and analyze threat intelligence data received from cyber threat vendors.
Monitor information security related websites (e.g., US-CERT, SANS Internet Storm Center) and mailing lists (e.g., SANS NewsBites, etc.) to stay current on the latest malicious code trends, exploits, and malware.
Participate in working groups that assess Iron Mountain's risk posture.
Analyze the potential impact of new threats and communicate risks to relevant business units.
Develop advanced threat detection rules based on analysis of intelligence.
Qualifications
Ten or more years of technical experience in the information security field, preferably in a Security Operations Center (SOC), Network Operations Center (NOC), or Computer Emergency/Incident Response Team (CERT/CIRT)
Eight or more years of practical Cyber Incident Management and Threat Hunting experience.
Advanced knowledge of information systems security concepts and technologies, including SIEM technologies, network architecture, database concepts, intrusion detection, cloud security, endpoint detection and response ( EDR), email protection, malware remediation; and computer forensic tools such as EnCase and open source alternatives.
Familiarity with security frameworks, such as NIST, and compliance standards such as HIPAA, GDPR, PCI, and FedRAMP.
Strong understanding of incident, problem, and change management is preferred.
Advanced knowledge and experience with the Windows and Linux operating systems.
Working knowledge and experience with investigating malicious code.
Demonstrated ability to apply technical and analytical skills in a security environment
Ability to work extremely well under pressure while maintaining a professional image and approach
Exceptional data analytics abilities; can perform independent analysis and distill relevant findings and root cause
Strong analytical writing skills; can articulate complex ideas clearly and effectively; experience creating and presenting documentation and management reports
Team player with proven ability to work effectively with other business units, IT management and staff, Legal, vendors, and consultants
Strong communication skills; can plan and lead effective meetings, conduct structured interviews to collect information, and present to a variety of audiences, including key stakeholders and decision makers
Experience in the following or similar tools: Chronicle Backstory,, Crowdstrike Falcon, Prisma Cloud, Check Point Next Generation Appliances, Tenable, Tanium, Google Cloud Platform, AWS, Azure.
Working understanding of threat intelligence, SOAR, and attack surface platforms.
Education/Certifications
Bachelor's degree in information systems, computer science, or related discip