Cyber Threat Analyst

Dwr Cymru Cyf; Cardiff; On-site; GBP 65,000 - 85,000; Full time

Benefits offered by this job

Enhanced employer pension

Cycle to work scheme

Health CashBack scheme

Free on-site parking

Job summary

Dŵr Cymru Cyf is seeking a dedicated Cyber Threat analyst to integrate cyber threat intelligence across security operations and expand threat detection in the OT environment. You will identify external threats to Welsh Water and stakeholders, draft management reports, and support incident response and vulnerability management.

You will work with the Head of Security Operations to mature the CTI framework and collaborate with security engineering to enhance monitoring and response use cases.

Qualifications

• Experience in cyber security operations, incident management or threat intelligence.
• Understanding of Cyber Kill Chain, MITRE ATT&CK and other security frameworks.
• Ability to work with external service providers and internal stakeholders.

Responsibilities

• Monitor threat actors and maintain security threat levels.
• Design and implement custom detection logic and threat hunts.
• Support vulnerability status analysis and remediation prioritisation.
• Provide SME input to technology projects and CTI programme development.
• Produce management reporting on threat intelligence and security operations.

Skills

Intelligence analysis

Stakeholder management

Threat hunting

Threat modelling

Education

GIAC/GCIA/GCIH/GDAT/GCDA/ISP

CompTIA Security+/CySA+

CRTIA/GCTI

Other security qualifications

Tools

STIX/TAXII

YAML

YARA

JSON

Job description

As our dedicated Cyber Threat analyst, you will lead our efforts to integrate cyber threat intelligence into all aspects of security operations, support the expansion of threat detection capabilities in the Operational Technology environment, proactively identify external cyber threats to Welsh Water and our customers, and provide expert cyber threat input to a variety of stakeholders. The role will have significant variety and a range of responsibilities critical to the delivery of our cyber security function. Day-to-day tasks will vary from implementing threat hunts based on the latest intelligence, proactively identifying high risk vulnerabilities using a range of specialist tools, to drafting monthly management reports highlighting current threat levels facing the business. Whilst cyber threat intelligence (CTI) sits at the core of the role, you will also augment the security analyst and vulnerability management team as required; supporting incident investigation, incident management, and the delivery of vulnerability management services. You will work closely with the Head of Security Operations to define and develop our CTI capability. This will include supporting the development of the CTI framework, maximising value from our CTI service providers, and designing CTI use cases.

Responsibilities

• Leverage intelligence analysis to monitor threat actors likely to pose a threat to the business. Maintaining the Security Operations Cyber Threat Levels
• Design and implement custom detection logic and threat hunts for tactics, techniques, tools, and procedures of specific cyber threats
• Leverage external service providers and open-source tooling to monitor the external technical attack surface and domain hygiene of the business
• Leverage external service providers and open-source to identify external threats to the business; including exposed information, dark web threats, and wider targetable data
• Develop and maintain the organisation's Strategic Threat Model and common intelligence picture
• Provide threat modelling support to Security Engineering & Architecture
• Provide SME Cyber Threat input to technology projects as required
• Analyse enterprise vulnerability status and support prioritisation of remediation activity
• Support the Head of Security Operations in development of the CTI programme for Welsh Water
• Support incident response and investigation
• Support the development of threat hunting and detection capabilities within the Operational Technology environment
• Support production of management reporting relating to threat intelligence picture and security operations
• Assess new threats to the business, seeking to optimise existing technology to better counter the issues identified
• Work with Security Engineering to enhance monitoring and response use cases
• Participate in and help coordinate training scenarios to exercise processes, tools and staff across the wider security team
• Stay up-to-date on the changing threat landscape and play an active role in appropriate intelligence-sharing communities
• Undertaking any other requirements as outlined by the line manager

Required Certifications and Experience

• GIAC Certification such as: GCIH, GCIA, GDAT, GCDA, GISP, GCFE . CompTIA Certification such as: Security+, CySA+
• Certification such as: CRTIA, GCTI
• Certification such as: Security+, CySA+
• Other formal intelligence/cyber security qualification
• Experience in any of the following: Cyber security; IT operations / engineering; Security incident management; intelligence, cyber threat intelligence
• Experience of understanding of the Cyber Kill Chain, MITRE ATT&CK and other information security defence and intelligence frameworks.
• Understanding of enterprise grade technical security controls and defence in depth
• Demonstrated experience in stakeholder management both internal and external
• Enthusiastic about putting our customers first every day
• Understanding of the cyber threat environment and approaches to threat intelligence delivery
• Strong understanding of intelligence analysis techniques
• Understanding of intelligence sharing formats and associated file types; such as STIX/TAXII, YAML, YARA, JSON
• Strong understanding of the Cyber Kill Chain, MITRE ATT&CK and other information security defence and intelligence frameworks

Dŵr Cymru Welsh Water keep 3 million people healthy each day with safe, reliable water, and take away wastewater to clean, before returning it safely to our beautiful rivers and seas.

To be able to deliver high quality, essential services which help to protect the health of our customers, colleagues and our environment, we need the right people to deliver on our vision. This is achieved by living our core values and demonstrating the core behaviours that underpin them. The security of our people, assets and information is key to us, so we are looking for people who understand and comply with the company's required security objectives. We know that the most successful teams are the most diverse teams. Equality, diversity and inclusion provide the very foundation to our culture at Welsh Water. We want every individual to feel confident, proud and able to bring their whole selves to work. To ensure an improved representation in our workforce, applications are particularly welcome from minority groups including Black, Asian and Minority Ethnic people, Females, LGBT+, Non-binary and people with disabilities. Together we continue to build a workplace that not only celebrates the diverse voices of our colleagues but also represents each customer we serve. In essence, ours is a company based on trust, openness, respect, commitment and honesty. A company that our colleagues are proud to work for.

Dŵr Cymru Cyf, a limited company registered in Wales No. 2366777. Registered office: Linea, Fortran Road, St. Mellons, Cardiff CF3 0LT

Benefits

• Variable pay schemes (your salary band will remain the same, but performance depending, you could receive an incremental within-band increase and a yearly incentive)
• Option to buy additional annual leave up to 5 days per year
• Enhanced employer pension contributions - Up to 11% employer contributions
• Free Mortgage Brokering Services
• Enhanced family friendly policies
• Progression opportunities, including the ability to apply for funded training and coaching and mentoring programmes
• Gym and fitness discounts as well as high street shopping
• Cycle to work scheme
• Discount off all Welsh Water visitor attraction centres and gift shops
• Car-leasing scheme and free on-site parking at all sites
• Health CashBack scheme and access to an online GP service
• An employee assistance programme for employees and their immediate family

Many more can be found on our website.

Due to the nature of the industry, we require satisfactory references, post offer medical clearance, and a criminal records Basic Disclosure check on all new employees joining the business. For some roles there may be additional checks and security clearance required, and this offer is subject to all checks being satisfied. You will receive further information on how to complete these checks via email once you have accepted this offer.