A top financial client is seeking a Cyber Security Detection & Response Sr. Analyst to work a hybrid schedule in Charlotte, NC.
Responsibilities:
The Sr. Analyst will:
- Perform penetration testing against products and systems, including web applications, web services, and mobile devices
- Assist with coordination of vendor pen testing services with internal development teams.
- Collaborate with stakeholders to develop remediation strategies
- Demonstrating practical/working exploitation of security flaws
- Develop and enhance process to automate the delivery of application security metrics.
- Review SAST/DAST output for false positives. Assist development with remediation.
- Serve as an application security subject matter expert.
- Participate in threat modeling exercises.
- Effectively communicate vulnerability details, risks, and potential impacts to, application owners, developers, stakeholders, and partners.
- Act as a mentor for junior team members/interns.
- Design, implement, and support security-focused tools and services.
- Develop tools that improve security testing, reporting, and monitoring.
- Lead investigations into information security incidents.
- Drive efforts towards containment of threats and remediation of environment during or after an incident.
- Perform complex security investigations and root cause analyses.
- Assemble and coordinate with technical teams and third-party vendors to resolve incidents as quickly and efficiently as possible.
- Ensure that all incidents are recorded and tracked to meet audit and legal requirements where necessary.
- Coordinate ingestion of threat intelligence as it pertains to the response process and relevant vectors of attack.
- Coordinate Cyber Hunting exercises and maintain playbook.
- Oversee direction for SOC team and L1 response procedures.
- Build/Review use cases to be incorporated into the response process for real time alerting.
Qualifications:
- 5+ years of experience in manual penetration testing of web and mobile applications
- Competent to work independently at an advanced technical level.
- Understanding of cloud technologies and environments (AWS, Azure, Google).
- Ability to demonstrate a clear understanding, at an enterprise level, of application, network, infrastructure, and data security architecture.
- Excellent analytical skills, able to manage multiple projects under strict timelines, work well in a demanding dynamic environment, and meet overall objectives.
- Ability to work under pressure and manage competing priorities.
- Knowledge of web application frameworks, deployment technologies and security software.
- Scripting capabilities for creating custom scripts to identify/exploit vulnerabilities.
- Strong writing skills to produce detailed reports for consumption by stakeholders at all levels from operations to executive.
Desired Qualifications:
- Proven work experience in manual secure code review.
- Experience working with GitLab Ultimate CI/CD technology, shift-left tools, and application security workflows.
- GPEN, OSCP, CISSP, GWAPT, CEH, or similar certifications.
- Desired scripting experience: One or more of Python, JavaScript, PowerShell, shell script, Ruby, PHP, LUA etc.
- Bachelor's degree in Information Technology or Computer Science, or equivalent experience.
- Inherent passion for information security and service excellence.
- The ability to adapt to new situations and the desire to learn and stay current with AppSec trends, threats, and risks.
Sr. Cyber Security Detection & Response Analyst