SeniorFull TimeENEurope
JOIN OUR DEVELOPMENT TEAM
At Levi Nine we are passionate about what we do. We love our work and together in a team we are smarter and stronger. We work in a dynamic and challenging environment with talented and forward-thinking people who are part of creative and innovative teams. We are looking for skilled team players who make change happen. Are you one of these players?
OUR PARTNER:
Our partner, ABN AMRO Clearing, is a global leader in the domain of clearing, offering access to a wide range of listed instruments on markets across the globe.
IT is at the heart of their organization with more than 30 different product teams and 10 different platform teams that are trying to build the best products & services for their customers.
Their presence in important financial centers like Amsterdam, Chicago, Sydney, Singapore, Tokyo Hong Kong, London, Sao Paulo, Frankfurt and Iasi, allows them to effectively serve clients worldwide and maintain close proximity to their diverse customer base.
THE ROLE INVOLVES:
The role is for our partner's CISO O&I department which is responsible for the daily security operations of ABN AMRO Clearing Bank. Their responsibilities include cyber threat intelligence, vulnerability management, security monitoring, and incident response. The team consists of security professionals located in Sydney, Amsterdam, and Chicago.
The global landscape of our partner contains a diverse combination of networking solutions, operating systems, and applications. To perform their daily operations, the teams rely on market leading security tools and technologies like EDR, SIEM, Vulnerability Scanners etc.
The vacant role contains multiple aspects of work in a Security Operations Centre with the mention that the primary focus will be on Cyber Threat Intelligence (CTI) and Security Monitoring.
As a CTI & SOC Analyst you play a critical role in keeping the company safe by assessing the risk and impact of threats and security incidents in a highly regulated environment.
Within CTI, they continuously collect data from internal sources, global ISACs, vendor advisories, government agencies, and open-source resources. Afterwards they process it and analyze it to determine its relevance to AACB. The intelligence output is utilized for threat hunting, use-case delivery, identifying potential incidents via emerging threats, exploited vulnerability or zero-day disclosures. Their (annual) reports are used for threat intelligence-based security assessments and organizational wide risk assessments.
For Security Monitoring it's about triaging security alerts and resolving incidents. The alerts are often escalated via their Managed Security Service Provider (MSSP) who provides Tier-1 SOC services to AACB, during the week and weekend. You will then swiftly perform triage and decide what actions should be done to contain the threat. For the analysis you will have access to several sources such as XDR, Firewalls, endpoints, and application logging. If an alert escalates to a security incident, you either resolve it yourself or connect with a team member to resolve it together.
Besides the daily operations, a big part of your role will be identifying areas of improvement and working with stakeholders to get these done. An improvement can range from a small modification to the implementation of a new tool, all while working together and challenging the stakeholders who are a part of this process.
Responsibilities:
Triage incoming cyber security alerts escalated from our MSSP.
Investigate cyber security incidents and work with team members to contain and remediate them.
Analyze cyber threat intelligence and escalate it towards specific teams.
Identifying improvements in the CTI domain.
Analyze new security threats and validate our controls against them.
Leading the implementation of new processes and tooling in the O&I team.
Guide stakeholders with their questions regarding Security Operations.
TECHNICAL PLAYGROUND:
6+ years' experience in SOC related activities such as Cyber Threat Intelligence, Security Monitoring or Incident Response.
Experience with the incident response life cycle.
Proven relevant experience in security operations work.
Good understanding of frameworks such as Cyber Kill Chain, MITRE ATT&CK.
A deep understanding of SIEM (Splunk) and/or EDR (Microsoft Defender) products.
Experience working with stakeholders to get things done.
NICE TO HAVE:
Certifications such as the following would be desirable but not mandatory: GCIH, GDAT, GCDA, GISP, OSDA, CCFR, SC-900, SC-200, Splunk.
A keen interest in cyber security and a desire to learn more.
Strong communication skills with stakeholders, both technical and non-technical.
Experience supporting junior team members.
A drive to improve the current way of working.
Relevant university degree in Computer Science, Engineering, or a related field.
SOFT SKILLS:
Fluent English, with good written and verbal communication skills.
Strong problem-solving skills and a proactive attitude.
Taking ownership on work that needs to be done, and you are flexible regarding possible standby hours.
Ability to give and receive feedback and not afraid to ask questions.
Flexible and adaptive working attitude - self-motivated and taking ownership.
Desire to continuously learn and improve in a complex, rapidly evolving environment.
