Cyber Security Analyst

TekWissen ®; Orlando (FL); On-site; USD 110,000 - 140,000; Full time

Benefits offered by this job

Equal opportunity employer

Job summary

TekWissen Group is seeking a Sr Incident Responder in Orlando to lead cyber incident response efforts, coordinate with leaders, and guide investigations. The role requires 5+ years in cyber defense, strong communication, and hands-on experience with SIEM tools and forensic analysis.

The ideal candidate will triage and manage incidents, preserve evidence, and work across cross-functional teams to contain threats. On-call rotations and ongoing program maturation are expected.

Qualifications

• Minimum 5 years in cyber defense with incident response, SOC, detection engineering, or similar.
• Experience leading or supporting incident response functions.
• Experience with industry-standard security toolsets in a layered defense model.
• Working knowledge of core Enterprise IT concepts (web app architectures, networking).

Responsibilities

• Apply current security technologies to cyber incident response actions.
• Maintain a clear investigative method preserving evidence and analyzing data to guide response.
• Respond to multifaceted security events and coordinate response efforts prioritizing mission-critical elements.
• Interact with various groups and leadership to accomplish responsibilities.
• Work with Cyber Response Manager to manage workflows, escalations, and process improvements.
• Triage escalated incidents and conduct containment/remediation actions.
• Oversee ticket queue triage, prioritization, and escalations.
• Analyze threat data from multiple sources to identify important alerts for escalation.
• Mitigate risk across Accounts, Hosts, Files, Networks, or handoffs to partner teams.
• Timeline multiple log sources to reach conclusions; document all analysis activity.
• Contribute to SOAR playbooks and runbooks; update response process docs.
• On-Call for escalated events for 1 week on a 5-week rotation.
• Collaborate with Incident Commanders to contain and remediate incidents.

Skills

Incident Response

SOC

Forensics

Splunk/SIEM

Communication

On-call readiness

Team collaboration

Education

Bachelor’s degree/Master’s in IT

Degree in Computer Science

Tools

Splunk

Job description

TekWissen Group is a workforce management provider throughout the USA and many other countries in the world Wide.

Job Description:

Qualifications/Requirements:

• English needs to be first language
• Bachelor’s Degree/Masters Degree in an IT related field and/or equivalent work experience
• Minimum 5 years working in Cyber Defense with experience in Incident Response, Security Operations Center (SOC), detection engineering, or similar functions.
• Previous experience supporting or leading incident response functions.
• Experience using industry-standard security toolsets in a layered defense model
• Working knowledge of core Enterprise IT concepts (web application architectures, networking, etc.)
• Experience with host-based and network-based forensics tools and analysis
• Knowledge of the cyber threat landscape to include different types of adversaries, campaigns, and the motivations that drive them
• Knowledge of industry recognized security and analysis frameworks (Mitre ATT&CK, Kill Chain, Diamond Model, NIST Incident Response, etc.)
• Exceptional written and verbal communication skills
• Must be self-motivated and able to work both independently and as part of a team
• Strong communication (both verbal and written) and client intimacy skills with experience briefing corporate executives and professionals
• Ability to be on call and provide support during nontraditional working hours
• Degree in Computer Science, or equivalent experience
• Security Operations Center experience preferred.
• Customer service experience, working with users over the phone, via email, and in person.
• Self-motivated with the ability to work independently.
• Splunk or other SIEM experience

From Intake Notes

• Forensic Analysis experience, Malware Analysis Experience
• Ability to timeline multiple data sources together
• Successful
• The ability to perform risk/impact analysis to know when to elevate to a manager
• Engineer mindset to make the operations better
• Can Prioritize tickets and solve problems efficiently.
• Unsuccessful
• Gatekeeping tickets and status; not providing updates to the team/management
• Incapable of reaching containment / lack of understanding of IR process and security threats

Soft Skills

• Professional Communications to management and executives
• Training downward to event analysts Thorough documentation

Responsibilities:

• The ideal candidate would have a working knowledge of current and relevant security technologies and how to apply them to cyber incident response actions.
• A clear investigative methodology with a focus on preserving evidence and analyzing data to form conclusions that will steer response directions.
• Experience responding to multi-faceted security events and incidents and assisting with the coordination of subsequent response efforts prioritizing mission critical elements.
• The role involves regular interaction with various groups and leadership within the organization to accomplish job responsibilities.
• Working closely with the Cyber Response Manager the Sr Incident Responder will manage workflows, escalations, and advance technical processes to build program maturity and growth.
• The successful candidate will be responsible for participating in the following activities:
• Day-to-day operational tasks related to the ongoing support of Threat Operations.
• Responsible for triaging escalated security incidents and conducting response actions to detect, contain and remediate identified security incidents.
• Responsible for overseeing ticket queue triage: prioritization, and escalations.
• Responsible for analyzing threat data from multiple sources and identifying security alerts and events of importance for direct escalation to response.
• Incident responders are expected to mitigate risk by taking response actions on either Accounts, Communications, Hosts, Files, Networks, or in some cases Handoffs to partner teams
• Identify and analyze multiple log sources into a timeline to reach a conclusion
• Incident Responders must keep detailed notes on all analysis activity, documented in the case management tool to validate process adherence.
• Responsible for contributing to the strategic creation and updating of new and existing SOAR playbooks and runbooks and response process documentation.
• On-Call for escalated events for 1 week on a 5-week rotation
• Work alongside Incident Commanders and Incident Handlers to contain and remediate named incidents

True Job Tile:

• Once escalation occurs – up to responder to reinforce deposition
• Conduct DFIR investigation and root cause analysis
• Security incident response models
• Security incident handling – once getting to a severity level and type of incident response communication for HM
• Clearly outline the security incident and steps taken and resolution tracking/documenting
• Providing updates throughout the lifecycle of the ticket
• Synthesizing work they did into bite size updates that go out to leadership
• Capable of understanding and updating the technical response plans as needed
• General understanding of security capabilities in order to recommend controls for containment
• Take knowledge form how to handle response, how to create plan, security capability outlook – able to find out the response action needed

TekWissen® Group is an equal opportunity employer supporting workforce diversity.