Information Security Analyst - Incident Response

Job Overview

This is an exciting time to join Wawanesa's Information Security team! We are adding to our incident response capability by growing our expertise in detection analytics and response automation ("detection engineering", SIEM, SOAR, threat hunting). Wawanesa's Cyber Threat Management team exists to provide verifiably timely, consistent, and thorough detection and response to cyber threats. Our team is a collaborative group of analysts responsible for threat detection, incident response, and cyber threat intelligence. The Information Security Analyst is monitoring and responding to cyber threats, and for the continued improvement of that capability. This position will focus on incident and threat management and providing analysis and reporting services in support of businesses/groups. You will work with many different data sources, and threat detection systems, and maintain a high degree of situational awareness of cyber threats. Your timely, consistent, and thorough response to those threats keeps our company safe.

To thrive in this team, you are someone that is curious, friendly, respectful, and supportive. You have an investigators mindset: looking for clues and following evidence to verify if our systems are under threat and acting to protect them. You will work with minimal supervision, but together with others in the Cyber Threat Management and other teams to achieve our shared goals.

Job Responsibilities:

• Detecting and assessing threats and incidents and determining their impact to Wawanesa's business operations, employees, or facilities
• Works with the information security team to develop strategies and plans to enforce security requirements and address identified risks.
• Participate in multi-step breach and investigative analysis to trace the dynamic activities associated with advanced threats.
• Perform investigation and escalation for complex or high severity security threats or incidents.
• Work with other security partners for developing and refining threat detection rules
• Work on complex tasks assigned by leadership, which may involve coordination of effort among different analysts.
• Coordinate evidence/data gathering and documentation and review Security Incident reports.
• Assist in defining and driving security initiatives.
• Create and develop detection and response processes and procedures working with different levels of analysts.
• Provide recommendations for improvements to Wawanesa's Security Policy, Procedures, and Architecture based on operational insights.
• Define and assist in creation of operational and executive reports.
• Maintain up-to-date procedure documentation for incident and threat management.
• Identify and assist with implementation of products and tools to ensure security of our infrastructure and applications, collaborating with all areas of IS to harden our environment.
• Interact with all levels within the organization to ensure activities are understood and completed appropriately.
• Participate in incident response on-call rotation.
• Performs other duties as assigned.

Qualifications

• Completion of Post-Secondary education, from an accredit institution in Cyber Security, Information Technology, or a related field.
• At least 3 years of Information Technology experience with at least 2 years of experience in cyber security operations, threat detection, or incident response
• Knowledge of cybersecurity, incident response, and threat modelling frameworks
• Practical experience with SPL, KQL, SQL, regex and/or other search and pattern matching languages.
• Experience with one or more of the following:
  • Familiarity with network-based services, client/server applications, mobile applications, enterprise systems and infrastructure, network architecture, and security infrastructure.
  • Understanding of firewalls, proxies, SIEM, antivirus and IDPS concepts.
  • Understanding of security controls, such as encryption, identity and access management, and vulnerability scanning.
• Ability to take initiative and respond with an appropriate sense of urgency.
• Ability to build and maintain high credibility with all business partners.
• Ability to document and explain technical concepts and details clearly and concisely.
• Ability to adjust priorities and manage time in an environment of change.
• Strong analytical and problem resolution skills.
• Strong verbal, written communications, and task management skills.
• Ability to document and explain technical concepts and details clearly and concisely to a variety of audiences (e.g., technical, business, auditors, etc.).
• Self-motivated and willing to accept additional responsibilities as position expands.
• Possess or actively working to obtain a professional cybersecurity certification (CISM, CISSP, or equivalent)
• Technical certifications in cybersecurity defense or forensics: GIAC etc. is considered an asset.
• Project management knowledge and experience considered an asset.