Responsible for regular oversight of program management and operations, and reporting program status to his/her manager.
Coordinate with enterprise-wide teams to provide installation, configuration, engineering, administration, and accreditation documents/diagrams for the IDPS solution life cycle. This may include replacements upgrades, enhancements, and new technology deployments.
Monitor and analyze Intrusion Detection Systems (IDS/IPS) logs to identify security issues for remediation.
Manage metrics and reporting with leadership and key stakeholders.
Provide architectural, design, and operational support to the Intrusion Detection and Prevention service.
Providing consultation services with regards to signature changes and updates.
Follow proper evidence handling procedures and chain of custody protocols, producing written reports documenting digital forensic findings.
Must have a good understanding of networks at a net flow, packet level, and analysis methodologies.
Assists in incident reports of analysis methodology and results.
Communicate requirements and guide security projects.
Maintain current knowledge of relevant cyber security technologies.
Assist with issues that have been escalated from the support analysts.
Perform audits, reviews, security control assessments, and tests of security operations based on established schedules
Perform real time analysis and trending of security log data from various security systems
Analyse security event data to identify suspicious and malicious activity
Provide inputs to improve security monitoring rules and alerts
Document processes related to security monitoring
Implement security protocols
Create emergency response procedures
Maintain data sources feeding the log monitoring system
Schedule security checks in accordance with reporting schedules
Prepare periodic status reports for presentation to management
Review security incident reports
Evaluate the type and severity of security events
Assist with establishing procedures for handling detected security events
Provide status updates during the life cycle of an incident
Create final incident report detailing the events of the incident
Support the maintenance and update of business recovery/contingency plans and/or procedures
Respond to user requests for technical assistance
Assess incident severity
Set clear user expectations on issue resolution
Update users on changes in status during issue resolution
Manage user accounts
Requirements
Degree in Computer Science, Engineering or a related subject with 3-5 years experience
Knowledge of next-gen firewall technologies
Knowledge of the Cisco Firepower, Checkpoint, Palo Alto and/or Fortinet
Solid understanding of common TCP/IP architecture, principles, operations and controls.
Solid understanding of network security firewall UTM technologies, trends, vendors, processes and methodologies.
Solid understanding of common IPS/IDS architectures and implementations.
Strong understanding of basic protocols used by the internet, such as HTTP(S), DNS, TLS
Solid understanding of basic networking concepts, such as routing, switching, firewall, and common enterprise security monitoring tools.
Solid understanding of information security principles
High degree of personal integrity and ethics as well as a passion for protecting people and systems
Constantly striving for excellence using objective, transparent and agreed upon standards
Excellent written and oral communication and presentation skills for leadership, technical and business audiences
Understanding of IPv6 technology, network and application implementations Understanding the concepts for network detection and reaction.