Security Detection and Response Analyst

About the opportunity

A leading financial services organisation is looking for an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, ideally using Splunk and your knowledge of current attack techniques to detect, investigate and respond to threats across web applications, networks and endpoints.

What you'll do

• Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity
• Use Splunk (or any other SIEM tool) to investigate security events, and build macros, alerts and dashboards that surface targeted attacks
• Identify common exploits and attack patterns (OWASP Top 10 and beyond) from web and event logs
• Interpret Apache, IIS and Active Directory logs alongside other security data sources
• Detect anomalous or malicious network activity using advanced analytics and security tooling
• Support incident response, recommending and helping implement mitigations, including WAF and CDN security controls
• Interpret stateful firewall rules and contribute to security operations procedures and continuous improvement

About you

Essential

• Strong intrusion analysis background, with proven ability to interpret web and application logs from a security perspective
• Solid understanding of how web applications work under the hood, including HTTP/HTTPS, DNS and TLS
• Knowledge of common web application attack vectors and current exploits, including SQL injection, cross-site scripting and remote file inclusion
• Experience independently investigating issues end-to-end and incident response experience
• Comfortable with scripting languages and regular expressions
• Working knowledge of enterprise client/server architecture
• Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
• Experience with Web Application Firewalls (WAF)
• Experience with Akamai or other CDN security controls beneficial

If this sounds like you, and you are a Permanent Resident or an Australian citizen, please apply at the earliest with your resume! You can contact Urvi Thacker for any queries.