Global Cyber Defense Analyst

Celonis•New York, NY

About The Position

We're Celonis, the global leader in Process Intelligence technology and one of the world's fastest-growing SaaS firms. We believe there is a massive opportunity to unlock productivity by placing AI, data and intelligence at the core of business processes - and for that, we need your help. Care to join us? The Team: This position will be part of the Celonis Global Cyber Defense Team (GCDT) and will cover the North America East Cost time zone. The GCDT is comprised of experienced Incident Response (IR) and Security Operations Center (SOC) personnel who work together closely to keep Celonis safe. The Role: This position is primarily responsible for the monitoring of security events and potential security incidents. This person will respond to security events and incidents in accordance with Celonis policies and procedures. The position will also participate in all pre and post incident activities as outlined in the Celonis Information Security Incident Response Plan, as outlined in the duties below.

Requirements

Analysis / Reasoning / Evaluation
Communications (Spoken) / Listening
Communications (Written)
Diligence
Practical Judgment
Questioning / Fact Finding
Organizing and Managing Self
Passion / Engagement
Practical Judgment
Self-Awareness / Self-Development
Stress Management
Familiarity with the following:
Application Security
Attack Frameworks
Cloud Platform Security
Container Security
Database Security
Email Security
Endpoint Security
Incident Response Frameworks
Incident Response Activities
Network Security
Social Engineering Techniques
Fundamental knowledge of the following:
Endpoint Detection & Response (EDR) Tooling
Log Analysis
Security Information & Event Management (SIEM) Tooling

Responsibilities

Assist in the development of processes and procedures to help improve detection and response capabilities
Assist with building out SOAR capabilities
Create and test Celonis Defense Procedures and IR Playbooks
Create Detection Use Cases
Document relevant incident information into the case management system, detailing the critical data for each incident to develop a historical record
Monitor the environment, SIEM, and other internal security tools for compliance violations, anomalous behavior, and potential attacks to respond to possible threats to the organization
Participate in shift turn over meetings between outgoing and incoming teams globally to pass along critical information and ensure any open cases are effectively transitioned
Perform initial analysis of all new alerts generated by correlation/alerting tools in addition to other external sources that will feed into the SIEM system and other security monitoring tools
Participate in on-call rotation