Sr. CyberSecurity Incident Response Analyst

Mountain America Credit Union•Sandy, UT

22h•Hybrid

About The Position

The Senior CyberSecurity Incident Response Analyst leads the enterprise-wide incident identification and resolution program. The role designs and implements incident management solutions, ensures adherence to the corporate incident response plan, and delivers service in line with organizational standards. It is a full-time hybrid position in Utah, located at Utah Mountain America Center, 9800 S Monroe Street, Sandy, UT 84070. The analyst monitors, detects, analyzes, and responds to cyber threats and incidents; investigates security alerts; conducts threat hunting and forensic analysis; and documents investigations and response actions. The role also develops and maintains incident response processes, playbooks, reporting, and security-tool capabilities. It includes leading post-incident reviews and training, conducting phishing simulations, and mentoring and collaborating with team members. This position has no managerial responsibility.

Requirements

Four years of directly related experience.
Extensive experience in incident response, cybersecurity, and threat analysis.
Strong knowledge of security platforms and tools, such as SIEM, EDR, IDS, and DLP.
Excellent analytical, problem-solving, and communication skills.
Ability to work independently and as part of a team.
Strong understanding of cybersecurity regulatory requirements and best practices.
Four-year college degree or equivalent experience.
Demonstrated proficiency with Microsoft Office Suite, including Outlook, Word, PowerPoint, and Excel.
Demonstrated ability to communicate clearly verbally and in writing, and to read and follow instructions.
Excellent customer service skills.
Proactively solves problems and improves processes and efficiencies.
Professionalism, personal discretion, and independent judgment.
Adaptability and a positive response to changed circumstances or conditions.
Excellent interpersonal skills, including the ability to lead and collaborate with multiple teams.
Willingness to learn and continually update knowledge of financial concepts, strategies, and systems.
Ability to sit, talk, and hear consistently; stand, walk, and use hands to handle or reach occasionally.
Close vision and distance vision.
Ability to lift up to 25 pounds occasionally and possibly up to 50 pounds.

Nice To Haves

Relevant certifications such as Security+, Project+, Web Security Associate, GCFE, or equivalent.

Responsibilities

Lead the enterprise-wide incident identification and resolution program.
Lead and manage incident management activities while delivering high-quality service in accordance with MACUWay.
Document and review complex security incident reports.
Create and maintain dashboards and periodic reports on historical threats, suspicious or anomalous activity, malware, and related matters.
Develop and execute processes to restore normal service securely and quickly after incidents and meet Service Level Agreements.
Lead post-mortem processes and reviews, and test fixes to confirm lessons learned have been resolved.
Establish and follow guidelines for log reviews and security community threat intelligence.
Lead and participate in incident response training sessions.
Correlate and analyze intrusion detection and prevention data with firewall, web server, DNS, and other data sources.
Assist with threat-hunting missions using threat intelligence, anomalous log analysis, scripts, and brainstorming results to detect and eradicate threat actors.
Respond to and investigate alerts from IDS/IPS, next-generation firewalls and malware protection, web proxies, DLP tools, and email spam filtering.
Assist with forensics and packet-level analysis on servers, endpoints, and appliances.
Maintain and validate chain of custody for evidence collected during incidents and security investigations.
Design and execute internal phishing simulations.
Assist in analyzing phishing emails, calls, and texts sent to team members and members.
Conduct and oversee employee security training.
Monitor, detect, analyze, and respond to cyber threats and incidents.
Correlate and analyze events and data to determine the scope of cyber incidents.
Acquire and analyze endpoint and network artifacts, volatile memory, malicious files or binaries, and scripts.
Document investigation and incident response actions in Archer and prepare formal incident reports.
Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
Tune and maintain security tools, including EDR, IDS, and SIEM, to reduce false positives and improve SOC detection capabilities.
Mentor and work with others on the team.
Perform other duties as assigned.