Senior Cyber Security Analyst - Incident Response (Remote)

First Citizens Bank is seeking a Senior Incident Response Analyst to join its Cyber Incident Response team. The role focuses on detecting, investigating, containing, and resolving cybersecurity incidents while supporting threat hunting, intelligence, monitoring, countermeasure development, stakeholder communication, and colleague mentoring.

Responsibilities:

• Incident Analyst/handler –investigate SIEM/SOAR events as necessary; bring experience in malware analysis, network/endpoint security to respond to and contain incidents
• Incident Responder/Incident Lead – Lead Incidents, coordinating the investigation, mitigation, and remediation from a technical perspective. Liaise with technical and business stakeholders
• Incident Management – Ensures Information Security incidents are properly detected, documented, investigated, and resolved
• Content Development - Support the creation of countermeasures and mitigations in response to an incident
• Threat Hunting - Support the operational driven inputs (eg. on the heels of an incident or event) into threat hunting and help build countermeasures/mitigations to address commodity and targeted threats. Also build a capability to track evolving threat actor techniques
• Post Incident Review – Provide recommendations to improve communication, processes, procedures, and mitigation options based on high severity incidents

Requirements:

• Minimum Required Education and Experience: Bachelor's Degree and 8 years' experience
• High School Diploma or GED/Equivalent and 12 years' experience in Information Security
• Cyber Incident Response experience – 3+ years required in which your primary job was an Incident Response role
• This role requires participation in the afterhours on call rotation.  Rotations will cycle on a weekly basis
• Experience with all aspects of Incident response including stakeholder management
• 2+ years of Threat Hunting experience
• Familiarity with MITRE ATT&CK and its application to countermeasure creation is a plus
• Experience analyzing/dispositioning and escalating security events (systems, application, network, authentication email events)
• Experience translating threat actor techniques to building mitigations across a variety of security technologies. This could take the form of Yara, Sigma or Regular Expressions
• Ability to define security requirements and drive project deliverables
• Ability to keep track of multiple incidents and ensure responses are provided in a timely fashion
• Experience responding to cloud-related incidents in Azure, AWS and Google cloud
• Cloud administrative experience preferred