Cyber Incident Response Lead

Summary

Join Experian's Global Security Office (EGSO)/Cyber Fusion Center (CFC) as a Cyber Incident Response Lead and become part of a growing team of specialized responders. You will be responsible for responding to, containing, investigating, and mitigating security events, working with various teams to ensure remediation and recovery. This role involves advanced incident response activities, coordinating workstreams, managing multiple cases throughout the incident response lifecycle, and maintaining detailed case documentation. You will also mentor junior analysts and contribute to the overall security strategy. The position requires a Bachelor's degree or equivalent experience and expertise in incident response, network security, and various security tools. A relevant certification is required, and a security management certification is preferred within two years. The role offers a regular Monday-Friday schedule with on-call expectations.

Requirements

• Bachelor's Degree in Computer Science, Computer Engineering, Information Security, or a related field, or 8+ years of experience working within Security Operations Centers or Cyber Security Incident Response Teams
• Demonstrated knowledge of Incident Response and Investigative Methodology
• Must have knowledge of network protocols (TCP/IP, UDP, ICMP), standard protocols (HTTP/S, DNS, SSH, SMTP, SMB), wireless networking, networking infrastructure, and network topologies (DMZ, VPN, WAN) and network technologies (WAF, IPS, Routers, Firewalls)
• Experience with commercial and open-source SIEMs, full packet capture tools, and network analysis tools (Splunk, Wireshark, SOF-ELK)
• Exhibit skills using common Incident Response and Security Monitoring applications such as SIEM (Splunk), EDR (FireEye HX, CrowdStrike Falcon, McAfee mVision EDR), WAF, IPS
• Demonstrated knowledge of common intrusion methods and cyber-attack tactics, techniques, and procedures (TTPs)
• Have at least one certification involving incident response, ethical hacking, cyber security (GCIH, E CEH, E CIH), or network forensics (GIAC Network Forensic Analyst (GNFA), NICCS Certified Network Forensics Examiner (CNFE))

Responsibilities

• Conduct advanced incident response activities to investigate and contain complex or larger-scale cybersecurity matters
• Orchestrate workstreams across teams (Forensics and Cyber Threat Hunting) and explain the CFC's overall understanding of the timeline of attacker activity so that appropriate containment and remediation actions can be coordinated
• Respond to cyber security events and alerts associated with threats, intrusions, or compromises per any applicable SLOs
• Manage multiple cases related to security incidents throughout the incident response lifecycle, including Analysis, Containment, Eradication, Recovery, and Lessons Learned
• Coordinate successful conclusion of security incidents according to Process & Procedures, and escalate severe incidents according to Experian's Incident Response Plan
• Maintain case documentation, including notes, analysis findings, containment steps, and cause for each assigned security incident
• Maintain assigned caseload and move incidents through each phase of the IR Lifecycle, handing off cases as needed for progress
• Maintain an understanding of common Operating Systems (Windows, Linux, Mac OS), Security Technologies (Anti-Virus, Intrusion Prevention), and Networking (Firewalls, Proxies)
• Interpret device and application logs from a variety of sources (Firewalls, Proxies, Web Servers, System Logs, Splunk, Packet Captures) to identify the root cause and determine the next steps for containment, eradication, and recovery
• Mentor and provide advanced support to analysts (Logs review, IP Block question)
• Support overall direction for the CFC and input to the security strategy

Preferred Qualifications

Hold one Security Management certification (ISC2 CISSP, CISM) or obtain such certification within the first two years as a Cyber Incident Response Lead

Benefits

• Great compensation package and bonus plan
• Core benefits including medical, dental, vision, and matching 401K
• Flexible work environment, ability to work remote, hybrid or in-office
• Flexible time off including volunteer time off, vacation, sick and 12-paid holidays