.Job SummaryThe Analyst is a position within Bain's Cyber Operations Department, whose mission is to safeguard the digital assets and integrity of the organization. In this role, the Analyst understands how security measures align with the overall organizational strategy and will contribute to the development and implementation of security controls that adhere to regulatory requirements and best practices. The Analyst will monitor, analyze and respond to potential security incidents and threats, analyze their urgency and impact to Bain, as well as implement necessary responsive measures to protect the organization's digital assets, data, and infrastructure. The Analyst Security Operations role has multiple disciplines including Security Monitoring, Incident Detection & Analysis, and more advanced disciplines in Threat Intelligence, Vulnerability Management, and Pro-Active Security Testing. Team members may spend a percentage of time across all disciplines or all of their time in a specific one.Principal Accountabilities and % of timeSecurity Monitoring (40%)
- Continuously monitor security systems, logs, and alerts to identify potential security incidents or vulnerabilities.
- Utilize and manage various security tools, including intrusion detection systems (IDS/IPS), firewalls, SIEM (Security Information and Event Management) solutions, and antivirus software.
- Stay updated and investigate the latest cyber threat intelligence, vulnerabilities, and attack techniques in our environment. Incorporate this knowledge into security monitoring and analysis.Incident Detection & Analysis (50%)
- Identify and analyze security threats, such as malware, data breaches, and unauthorized access to determine potential impact.
- Generate regular and ad-hoc reports on security incidents, vulnerabilities, and trends for management and other stakeholders.
- Execute and modify incident response playbooks to mitigate the effects of security alerts and restore normal operations.
- Ensure that controls identified in the Policies are maintained and validated per the Policy.Professional Development and Innovation (10%)
- Stay informed about emerging trends and technologies in cybersecurity.
- Work collaboratively with other security team members, IT departments, and relevant business units to address security concerns and enhance overall security posture.
- Explore Professional Certifications and work with leadership to plan trainings.Knowledge, Skills, and AbilitiesSecurity Monitoring & Incident Detection and Response & Analysis
- Strong knowledge of Splunk (or other SIEM tools), CrowdStrike, Windows Defender, Other AV/EDR tool configuration, Cyberhaven (or other DLP tools).
- Knowledge of Vulnerability & Attack Surface Management toolsets, Threat Intelligence and Analysis tools, Vendor technical Risk Scoring tools, Deception technologies.
- Knowledge of ticketing, triage and forensics capabilities and toolsets