Only W Incident Response Analyst

Job Description: Incident Response Analyst

Hybrid - New York, NY

What are the top skills required for this role?

1. Incident Response support along with client team and SOC provider.
2. Would need to understand the broader Crowdstrike Falcon ecosystem

Job Description/ Responsibilities

Would need to understand the broader Crowdstrike Falcon ecosystem. Would also need to understand to understand sensor management, policy configuration. Perform the Incident Response support along with client team and SOC provider.

Key activities include:

• Responsible for documenting evidence throughout the incident life cycle, conducting shift handovers, escalating security events to incident response, and providing support during cyber security incidents
• Responsible for the ticket queue triage: prioritization, assignment and disposition of security incident tickets/events.
• Responsible for analyzing threat data from multiple sources and building evidence backed dispositions.
• Responsible for front line triage and response including some containment and remediation actions such as network isolation of hosts and blocking indicators of compromise within security perimeter tools.
• Analyst must keep detailed reports on all analysis activity, documented in the case management tool to validate process adherence.
• Responsible for contributing to the creation and updating of new and existing SOAR playbooks and runbooks and general response documentation.
• Monitor the client's security detection and response program to protect the client's Data and IP from both internal and external threats
• Hunt for, detect, and respond to malicious activity and anomalous events on client devices and networks
• Utilize client tools to automate detection and automatically find and address future vulnerabilities
• Manage/coordinate remediation efforts after security assessment findings outline weaknesses requiring attention.
• Working with the threat modelling lead in Security Architecture to integrate TM tools into the Security Design Review Process.
• Review Vendor software/hardware and Third-Party information security integration controls/risks and document gaps and issues for action.
• Document, formulate and enforce areas of security improvement that balance risk with business operations and do not diminish efficiencies or innovation.
• Foster strong cross-functional relationships internally between Infrastructure, Application teams and external vendors.