First Line Security Events Analyst

Duties:

> As a First Line Security Event Analyst (FLSEA), the contractor will perform initial analysis of logs and network traffic, determine alert severity and escalate when required.
> The analyst will collate information and present findings in a clear, structured format, providing remediation recommendations and first line response where applicable.

Main responsibilities

> Conduct research and assessments of security events within NATO Cyber Security Centre (NCSC) team
>Provide analysis of firewall, IDS, anti-virus and other network sensor produced events and present findings
> Appropriately leverage the comprehensive extended toolset (e.g. Log Collection,Intrusion Detection, Packet Capture, VA, Network Devices etc.) for enhancing investigations
> Support the end-to-end Incident Handling process
> Propose optimisations and enhancements which help to both maintain and improve NATO’s Cyber Security posture

Requirements:

> A university degree in a technical subject with a focus on Information Technology (IT), obtained from a nationally recognized/certified institution in addition to a minimum of 1 year experience in the field of cyber security analysis. > The lack of a degree may be compensated by at least 3 years of relevant experience in field of cyber security analysis. Similarly, candidate’s lacking experience can compensate by demonstrating a high level of knowledge in the field of cybersecurity.
> Comprehensive knowledge of the principles of computer and communications security including knowledge of TCP/IP networking, Windows and Linux operating systems
> Broad understanding of common network security threats and mitigation techniques
> Experience with Security Information and Event Management products (SIEM) – e.g. ArcSight, Splunk
> Experience with analysis of Network Based Intrusion Detection Systems (NIDS) events– e.g. SourceFire, Palo Alto Network Threat Prevention
> Experience with Log analysis from a variety of sources (e.g. Firewalls, Proxies, Routers, DNS and other security appliances)
> Experience with Network traffic capture analysis using Wireshark
> Logical approach to analysis and ability to perform structured security investigations using large, complex data sets
> Ability to work independently and as part of a team
>Shift work