Security Detection and Response Analyst

Morgan McKinley; Sydney; On-site; AUD 90,000 - 130,000; Full time

Job summary

Morgan McKinley in Sydney is seeking an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, leveraging Splunk to detect, investigate and respond to threats across web applications, networks and endpoints, and contribute to continuous improvement of security operations.

Qualifications

• 3–6 years' experience in a security analytics role.
• Strong intrusion analysis background with log interpretation.
• Solid understanding of web applications and HTTP/HTTPS, DNS, TLS.
• Knowledge of web app attack vectors (SQLi, XSS, RFI).
• Experience with incident response and end-to-end investigations.
• Scripting and regex proficiency; familiarity with enterprise client/server architecture.
• Experience with WAF and CDN security controls.

Responsibilities

• Analyse web, application, authentication, endpoint and security logs to identify malicious activity.
• Use Splunk to investigate security events, build macros, alerts and dashboards.
• Identify exploits and patterns from logs and events.
• Interpret Apache, IIS and AD logs alongside other security data sources.
• Detect anomalous network activity using analytics and tooling.
• Support incident response and help implement mitigations, including WAF/CDN controls.
• Interpret stateful firewall rules and contribute to SOC procedures.

Skills

Threat analysis

Incident response

Log analysis

Regex scripting

SOC operations

Web security fundamentals

Splunk

WAF

CDN security controls

Tools

Splunk

WAF

Akamai CDN

Firewall rules

Job description

A leading financial services organisation is looking for an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.

You'll work in a high-performing security team, ideally using Splunk and your knowledge of current attack techniques to detect, investigate and respond to threats across web applications, networks and endpoints.

What you'll do

• Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity
• Use Splunk (or any other SIEM tool) to investigate security events, and build macros, alerts and dashboards that surface targeted attacks
• Identify common exploits and attack patterns (OWASP Top 10 and beyond) from web and event logs
• Interpret Apache, IIS and Active Directory logs alongside other security data sources
• Detect anomalous or malicious network activity using advanced analytics and security tooling
• Support incident response, recommending and helping implement mitigations, including WAF and CDN security controls
• Interpret stateful firewall rules and contribute to security operations procedures and continuous improvement

About you

Essential

• 3-6 years' experience in a similar role
• Strong intrusion analysis background, with proven ability to interpret web and application logs from a security perspective
• Solid understanding of how web applications work under the hood, including HTTP/HTTPS, DNS and TLS
• Knowledge of common web application attack vectors and current exploits, including SQL injection, cross-site scripting and remote file inclusion
• Experience independently investigating issues end-to-end and incident response experience
• Comfortable with scripting languages and regular expressions
• Working knowledge of enterprise client/server architecture
• Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
• Experience with Web Application Firewalls (WAF)
• Experience with Akamai or other CDN security controls beneficial