Key Responsibilities
Monitor and analyze security alerts from SIEM, EDR, firewalls, IDS/IPS, cloud platforms, and identity systems.
Conduct detailed investigations into high-severity security incidents, including phishing, malware, lateral movement, data exfiltration, and related threats.
Lead end-to-end incident response activities, including containment, eradication, recovery, and post-incident documentation.
Develop and fine-tune SIEM correlation rules, EDR detections, and alerting policies to reduce false positives and improve detection coverage.
Execute proactive threat hunting using the MITRE ATT&CK framework and IOCs across endpoints, network, cloud, and identity logs.
Monitor Data Leak Prevention / Data Loss Prevention (DLP) tools and recommend strategies to prevent unauthorized data exfiltration.
Stay up to date with the latest cybersecurity trends, threats, tools, and technologies to continuously strengthen the firm’s security posture.
Qualifications
Bachelor’s degree in computer science, Information Technology, Cybersecurity, or a related field.
Minimum 4+ years of experience in SOC, incident response, or a related cybersecurity operations role, preferably within financial services.
Proficiency in query languages and log analysis tools such as KQL, SPL, or similar for threat hunting and investigations.
Strong understanding of the MITRE ATT&CK framework, cyber kill chain, and common attack techniques, including phishing, credential theft, lateral movement, and data exfiltration.
Hands-on incident response experience, including evidence collection, investigation documentation, and stakeholder communication.
Strong analytical and problem-solving skills, with the ability to communicate technical findings clearly to non-technical stakeholders.
Relevant certifications such as GCIH, GCIA, CEH, OSCP, or equivalent are preferred.
Prior experience working in financial services is a plus.
#LI-SK1
