Cyber Defense Officer

Tasks

• Security Operations (L1/L2):
  • Conducting continuous security monitoring, triage, and detailed analysis of security incidents (e.g., incidents, malware, phishing, etc.)
  • Cyber Level 1 (L1) and Level 2 (L2) incident response activities, from initial detection, triage, containment, remediation, and recovery, to ensure timely resolution and risk mitigation
  • Monitoring, reviewing, and tracking security incidents to ensure timely resolution, maintain comprehensive documentation and case management throughout the entire incident lifecycle, and facilitate communication with stakeholders
• Cyber Threat Intelligence (CTI):
  • Identification of cyber threats, such as critical vulnerabilities relevant to the bank, and assessment of their potential for exploitation
  • Conducting proactive threat hunting activities to search for specific Indicators of Compromise (IOCs) and Tactics, Techniques, and Procedures (TTPs)
  • Collecting and analyzing information from internal networks and external sources to predict and proactively address emerging cyber threats
  • Support in evaluating detective and protective security controls by simulating or carrying out real cyberattacks on the bank's infrastructure
• Other Cyber Defense Responsibilities:
  • Assistance with cyber investigations as needed, including the operation of relevant forensic and incident response tools
  • Support for the engineering stream in automated attack simulation testing
  • Support the engineering team in the development and maintenance of detections, as appropriate
  • Support with project implementation, where applicable
  • Support for internal and external audits by coordinating reviews, facilitating the preservation of evidence, and providing technical expertise as needed

Requirements

• Personal and social:
  • Strong interpersonal, communication, and presentation skills
  • Self-motivated and able to work independently to drive initiatives and tasks forward
• Professional and technical:
  • Bachelor's degree in information security, computer science, computer engineering, or a related field
  • Proven experience in Level 1 and Level 2 security operations, threat analysis, and incident response
  • Strong expertise in cybersecurity operations with hands-on experience in SIEM, SOAR platforms, GUI development, and dashboarding
  • Strong programming and scripting skills (e.g., Python) for automation and the development of custom rules/workflows
  • Familiarity with Security Orchestration, Automation, and Response (SOAR) tools is a plus
  • Experience with artificial intelligence, particularly generative AI, is a plus
  • Professional certification in information security (e.g., Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM)) and knowledge of MITRE ATT&CK are a plus but not required