Incident Response Analyst

23 hours ago

Apply Now

Receive Emails with Similar Jobs

CompuWorks

WebsiteLinkedInAll Job Openings

Managed IT Services • Virtual CIO • Service Desk • IT Projects

11 - 50

Description

• The Incident Response Analyst is a front-facing role, working directly with incoming alerts, reports, and metrics to monitor and maintain the security of Sourcepass’ clients. • The Response Analyst will help lead the SOC team, acting as a subject matter expert when questions arise. • The Response Analyst will be on-hand to respond to incidents that occur within client environments. • The Response Analyst will participate in the identification, containment, eradication, recovery, and reporting of incidents. • Some incidents will be handled remotely, while others will require onsite travel. • When not working incidents, the Response Analyst will perform triage work alongside the Security Analysts.

Requirements

• Bachelor’s Degree or better from an accredited institution • Willingness to learn and improve both core function skills and potential additional security role skills • Both strong written and strong verbal communication skills, both internally and client-facing • Basic understanding of SOC practices and processes • Strong understanding of incident response practices and processes (familiarity with NIST SP 800-61r2, 800-83, and 800-86 desired; MITRE ATT&CK framework a plus.) • Strong understanding of the Windows operating system (Linux and Macintosh a plus) • Strong understanding of the Windows ecosystem (Active Directory, Azure, Microsoft365) • Experience with ticketing and tracking systems • Strong knowledge of networking protocols and topologies, as well as network analysis • Intermediate understanding of malware analysis • Analytical, problem solving, critical thinking skills • Strong understanding of OS and network auditing • Knowledge of scripting languages (PowerShell, batch, etc.) a plus • Knowledge of compliance frameworks (HIPAA, PCI, Title 23 NYCRR 500, NIST SP 800-171, etc.) a plus • Security+, E|CIH, & GCIH certifications (or equivalents) all preferred