Sr. CyberSecurity Incident Response Analyst

Mountain America Credit Union•Sandy, UT

2d•Hybrid

About The Position

The Senior CyberSecurity Incident Response Analyst leads the enterprise-wide incident identification and resolution program. The role designs and implements incident management solutions, ensures adherence to the corporate incident response plan, and provides high-quality service in line with the organization’s standards. This senior individual contributor position includes mentoring and collaborating with teammates, but has no managerial responsibility. The analyst monitors, detects, analyzes, and responds to cyber threats and incidents; investigates alerts across security platforms; analyzes endpoint and network evidence; and documents investigations and formal incident reports in Archer. The role also develops and maintains incident response processes, procedures, workflows, playbooks, dashboards, and reports; tunes security tools to improve detection; and supports threat hunting, forensics, phishing simulations, and employee security training. The position is full-time and hybrid in Utah, at Mountain America Center, 9800 S Monroe Street, Sandy, UT 84070. The work is in a typical business-office environment with moderate noise.

Requirements

At least 4 years of directly related experience.
Extensive experience in incident response, cybersecurity, and threat analysis.
Strong knowledge of security platforms and tools, such as SIEM, EDR, IDS, and DLP.
Excellent analytical, problem-solving, and communication skills.
Ability to work independently and as part of a team.
Strong understanding of cybersecurity regulatory requirements and best practices.
Four-year college degree or equivalent experience.
Proficient with Microsoft Office Suite, including Outlook, Word, PowerPoint, and Excel.
Ability to communicate clearly verbally and in writing and to read and follow instructions.
Excellent customer service skills.
Proactively solves problems and improves processes and efficiencies.
Professional judgment, personal discretion, and ability to exercise independent judgment.
Adaptable to change and responsive to altered circumstances or conditions.
Strong interpersonal skills, including ability to lead and collaborate with multiple teams.
Willingness to learn and continually update knowledge of financial concepts, strategies, and systems.
Ability to sit, talk, and hear consistently; stand, walk, and use hands to handle or reach occasionally.
Close vision and distance vision.
Ability to lift up to 25 pounds occasionally and potentially up to 50 pounds.

Nice To Haves

Relevant certifications such as Security+, Project+, Web Security Associate, or GCFE, or equivalent.

Responsibilities

Lead an enterprise-wide incident identification and resolution program.
Lead and manage incident management activities while providing high-quality service consistent with MACUWay.
Document and review complex security incident reports.
Create and maintain dashboards and periodic reports documenting historical threats and suspicious or anomalous activity, including malware.
Develop and execute processes to restore normal service operation quickly and securely while meeting Service Level Agreements.
Lead post-mortem processes and reviews, and test fixes to confirm lessons learned have been addressed.
Establish and follow guidelines for log reviews and security-community threat intelligence.
Lead and participate in incident response training sessions.
Correlate and analyze intrusion detection and prevention data with sources such as firewall, web server, and DNS logs.
Assist with threat-hunting missions using threat intelligence, anomalous log data, scripts, and brainstorming to detect and eradicate threat actors.
Respond to and investigate alerts involving IDS/IPS, next-generation firewalls and malware protection, web proxies, DLP tools, and email spam filtering.
Assist with forensics and packet-level analysis on servers, endpoints, and appliances.
Maintain and validate chain of custody for evidence collected during incidents and security investigations.
Design and execute internal phishing simulations.
Assist in analyzing phishing emails, calls, and texts directed to team members and members.
Conduct and oversee employee security training.
Monitor, detect, analyze, and respond to cyber threats and incidents.
Correlate and analyze events and data to determine the scope of cyber incidents.
Acquire and analyze endpoint and network artifacts, volatile memory, malicious files or binaries, and scripts.
Document investigation and incident response actions in Archer and prepare formal incident reports.
Develop, document, and maintain incident response processes, procedures, workflows, and playbooks.
Tune and maintain security tools such as EDR, IDS, and SIEM to reduce false positives and improve SOC detection capabilities.
Perform other duties as assigned.