Second Line Security Analyst (Protective Monitoring)
Basingstoke (BSN01) or Bracknell (BRA01) with flexibility to travel between.
The SDWAN Support Team are looking for a Second Line Shared Service Security Analystto work collaboratively across our accounts. Your role will involve direct technical support for all Protective Monitoring elements as part of the 2nd Line Team and assist in the day-to-day operations and duties of the DNS SD-WAN Service. The analyst will also work with the current support personnel to understand the products and their use across the shared service and to develop their diagnostic skills / capability.
The role can be completed in either our Basingstoke or Bracknell office and occasional travel may be required to support a team across both sites delivering an active-active service. Due to the nature of the work and security classification of our clients, this activity is on-site only or the foreseeable future. Whilst no customer site visit work is expected, there maybe a requirement to attend and support proactive workshops with the customer and our security teams to help improve the monitoring and alerting activities.
Your experience
1. Have a solid understanding of cyber security concepts and related technology including basic attack techniques and related.
2. Understand risk concepts and their impact.
3. Hands-on experience with security case management is useful.
4. Familiar with logging, Windows events, syslog, etc.
5. Experience and awareness of NCSC security principles and familiar with implementing these principles in operational environments.
6. Experience and knowledge of SIEM toolsets and others such as Elastic, LogRhythm, NMAP, Nessus, Wireshark, etc.
7. A good understanding of basic network protocols and services.
8. A basic understanding of IPSec.
9. Experience working with Cisco routers, Juniper firewalls, vmware are beneficial.
10. Comfortable producing and maintaining documentation.
11. Comfortable communicating with peers and more senior project members.
The types of activities to be undertaken are:
12. Configuration, maintenance and continual improvement (tuning) of alerting rules and dashboards.
13. Triage and investigate SIEM alerts, ensuring comprehensive case management and appropriate action taken.
14. Proactively identify potential SIEM and/or overall security posture improvements.
15. Occasionally attend Teams calls as the Protective Monitoring (ProMon) representative.
16. Syslog auditing – identify, document and escalate blind spots in our syslog collection.
17. Assist other RGs in the identification of specific activities/logs (or lack thereof).
18. Assist 3rd Line security analysts with any other duties that may require additional resources.
19. Anomaly detection and investigation.
You must be eligible and willing to undergo a high level of UK Security clearance.
Your benefits:
26 Days annual leave plus public holidays (3 flexible)
Pension – Double matching contributions of up to 10%
Life assurance
Companywide incentive plans
Your choices (Flexible benefits such as increased holidays / travel / dental critical illness and more)
Perks at work – employee discounts
Employee assistance programme / virtual GP