MONTRÉAL [HYBRID] - Production CSIRT Analyst Level III

WHO WE ARE:

As the founding entity of RAINBOW PARTNERS, Quanteam is a consulting firm specializing in Banking, Finance, and Financial Services. Guided by our core values of closeness, teamwork, diversity, and excellence, our team of 1,000 expert consultants, representing 35 different nationalities, collaborates across 10 international offices: Paris, Lyon, New York, Montreal, London, Brussels, Geneva, Lisbon, Porto and Casablanca.

We are looking for a Production CSIRT Analyst Level III to work with one of our clients.

CONTEXT AND ROLE OBJECTIVES:

The Production CSIRT Analyst Level III position will provide security expertise to the 24x7 Security Operation Center (SOC). The primary purpose of this position is to help coordinate and report on cyber incidents impacting the bank's critical assets by detecting, preventing, and responding to cyber threats against the group's infrastructure. It provides critical support to the firm-wide cybersecurity program via partnerships in the region within diverse lines of business, and externally with clients, partners and regulators.

As a Production Security Analyst, you are not only responsible for hands-on real-time monitoring, analysis, and resolution of identified security incidents, but also for the continual development and improvement of the 24x7 SOC capabilities as the first line of defense to identify potential information security incidents.

KEY RESPONSIBILITIES:

Responsibilities include but are not limited to:

• Provide analysis and trending of security log data from many heterogeneous security devices

• Responsible for use-case development and validation

• Provide Incident Response (IR) support or escalation when analysis confirms an actionable incident

• Provide threat and vulnerability analysis as well as a security advisory service

• Develop threat hunting program and capabilities

• Analyze and respond to previously undisclosed software and hardware vulnerabilities

• Investigate, document and report on information security issues and emerging trends

• Perform threat hunting to identify potential adversaries within the network

• Perform forensics analysis on compromised systems to identify the extent and nature of the compromise and provide recommendations on remediation steps

• Provide support and/or research any security-related questions or incidents

• Perform tasks independently with some oversight

• Integrate and share information with other analysts and other teams

• Monitor bank sources of potential security incidents, health alerts with monitored solutions and requests for information, including real-time channels or dashboards, periodic reports, email inboxes, helpdesk or other ticketing systems, telephone calls and chat sessions

• Follow incident-specific procedures to perform triage of potential security incidents to validate and determine needed mitigation, and maintain said procedures up to date

• Escalate potential security incidents to Level IV engineers, implement countermeasures in response to others, and recommend operational improvements

• Keep accurate incident notes in the case management system

• Maintain awareness of the bank's technology architecture, known weaknesses, the architecture of the security solutions used for monitoring, imminent and pervasive threats as identified by client threat intelligence, and recent security incidents

• Continuously improve the service by identifying and correcting issues or gaps in knowledge (analysis procedures, plays, client network models), false positive tuning, identifying and recommending new or updated tools, content, countermeasures, scripts

• Serve as a subject matter expert in at least one security-related area (e.g., specific malware solution, Python programming)

• Actively seek self-improvement through continuous learning and pursuing advancement to a Level IV Analyst

• Adhere to internal operational security and other internal policies

• Perform light project work as assigned

PROFILE:

Mandatory requirements

• Knowledge or 3-5 years of experience with the following technologies: SIEM, ELK, IDS/IPS, network- and host-based firewalls, data leakage protection (DLP)

• Direct experience with anti-virus software, endpoint detection response (EDR), firewalls and content filtering

• Experience or demonstrable knowledge in incident response, log analysis and PCAP analysis

• Good level of knowledge in network fundamentals, for example OSI Stack, TCP/IP, DNS, HTTP(S), SMTP

• Good level of understanding of the approach threat actors take to attacking a network: phishing, port scanning, web application attacks, DDoS, lateral movement

• Knowledge in Windows and/or Linux operating systems, how to investigate them for signs of compromise

• Passion to learn and to contribute to the ongoing development of the team

Nice to have

• Certifications like GCFA, GCIH, OSCP, or similar are recommended

• Foundational level of scripting knowledge

• Ability to demonstrate the right approach to investigating alerts and/or indicators and document your findings in a manner that both peer and executive level colleagues can understand

• Appreciation of the wider roles of interconnecting Cyber Security teams and collaboration with each of those (i.e., Forensics / Threat Intelligence / Penetration Testing / Vulnerability Management / "Purple Teaming")

• Ability to handle fluctuating workloads, conflicting priorities, and concurrent activities

• Analytical skills, strategic vision, rigor and accuracy, flexibility, communication skills, collaboration, self-driven

Work setup: 4 days per week on-site in Montréal.