Purpose and Objective

Purpose of the role is to help us to facilitate security incident response handling and contribute on enhancements of the security incident response processes and their implementation into the already existing security tools and procedures.

Key Performance Indicators

• Supports and adheres to Company’s core values
• Performs other duties or responsibilities as assigned or required
• Supports and adheres to Company’s Code of Conduct and Ethics Policy
• Represents Company in a positive, professional manner when working with both internal and external customers

Core Areas of Responsibility / Accountability

• Investigate cyber security incidents and drive the remediation actions to completely remove the threats in both onpremise and cloud environments
• Track the remediation actions’ progress to make sure they are followed by appropriate personnel within the expected timeframe; escalate if needed
• Suggest preventive actions and drive the effort to implement them globally to minimize the risk that particular security issues can occur again
• Participate in incident response process enhancements, suggest changes, implement them and document
• Create runbooks and workflows for specific incident types, implement them into the existing security incident tracking tool
• Create reports to provide the overview of the current incident response situation as well as trending over time for various types of audience, e.g. Top-level Management, CISO, Security Team members, etc.
• On-call support for Critical severity security incidents

Requirements

• Advanced English (mandatory): ability to communicate fluently with global stakeholders, produce documentation and reports, and participate in meetings in English
• Minimum bachelor’s degree in IT is preferred or equivalent knowledge
• Broad cyber security knowledge (4+ years) and experience in Incident Response area (2+ years)
• Knowledge of a cloud environment (e.g. GCP, AWS, Azure)
• Understanding of Cloud Security and related threats and vulnerabilities
• Familiarity with common attack methodologies, tactics and protocols, Advanced Persistent Threat groups and hacker activities
• Good understanding of networking, TCP/IP protocols and ISO/OSI model
• Hands-on experience with ServiceNow as SecOps module admin