Hybrid Cybersecurity Incident Responder

at Datacom

• Job title: Cybersecurity Incident Responder
• Job type: Full Time
• Experience level: Mid level, Senior
• Salary: Not specified
• Degree requirement: Bachelor's Degree
• Tech skills: Cyber Security, Python, Ruby, Splunk
• Location requirements: Hybrid, Wellington, New Zealand

About the role

• Cybersecurity Incident Responder in Datacom's CSIRT team investigating major incidents and conducting digital forensics. Collaborating with stakeholders and providing proactive response services.

Responsibilities

• Conduct thorough investigations into major security incidents, determining root causes, impact, and mitigation strategies. Providing expertise and support to contain, eradicate, and recover from such security incidents.
• Conduct analysis of affected systems utilising forensic techniques to thoroughly examine system events and adversary activities.
• Utilise security tooling such as EDR, SIEM, XDR, & Identity technologies to assist your investigation of confirmed or suspected compromises.
• Undertake log & correlation analysis and construct a timeline of adversary activities.
• Identify intrusion vectors & root causes and develop recommendation actions to prevent similar incidents.
• Collect digital forensics evidence from affected systems in accordance with industry standards for image acquisition and preservation of digital evidence.
• Produce comprehensive, detailed DFIR reports outlining the investigative steps undertaken, your findings, and recommendations.
• Support the coordination of containment, eradication and recovery efforts based on available information and established processes.
• Analysis of incident response effort, with feedback from the customer and third parties as part of Post Incident Reviews (PIRs) and Lessons Learned.
• Deliver proactive incident response services which include tabletop exercises, threat hunting, compromise assessments, breach readiness assessments, threat intelligence briefings, and threat modelling.
• Communicate with senior stakeholders within Datacom and our customers.
• Work with other members of the CSIRT team, to develop the technical capabilities of the CSIRT - including improving the processes and technology to deliver successful outcomes to customers and stakeholders.
• Participate in an on-call roster for major incident response.
• Occasional planned or last-minute/urgent travel to customer sites will be required for certain customer facing engagements. This may include a customer site in your home city, or travel to other customer sites within Australia and New Zealand.

Requirements

• The mindset of an investigator. We are looking for someone who is able to search for evidence of compromise and previously undetected adversary behaviour.
• Confidence in communicating with a variety of senior stakeholders, including Senior Leadership teams in difficult / tense situations.
• Experience in responding to high-profile cybersecurity incidents that have had significant operational or privacy impacts to the affected organisation such as ransomware & data breaches.
• Experience in digital forensics & incident response (DFIR) with an understanding of key system & digital forensic artifacts and how they are useful in a cybersecurity investigation.
• Experience using DFIR tools such as EnCase, X-Ways, Magnet Axiom, Velociraptor, KAPE, & THOR.
• Proven knowledge and experience of efficiently searching large datasets across multiple log sources and underlying platforms including XDR/EDR and SIEM products such as CrowdStrike, Microsoft Defender, Splunk, or Sentinel.
• A strong understanding of current and emerging attacker behaviours, tools, tactics, and techniques.
• An understanding of various security frameworks and methodologies such as NIST CSF, MITRE ATT&CK and D3FEND, Unified Kill Chain and OWASP Top 10.
• Basic scripting or automation skills are desirable (for example PowerShell, Bash, Python, or Ruby).
• SANS GCFA, GCFE, GCIH, or relevant DFIR certifications are desirable.