Information Security Analyst II

First Citizens; Raleigh (NC); Remote; USD 110,000 - 140,000; Full time

Job summary

A leading financial institution is seeking an experienced Security Event Telemetry Triage Analyst for a remote role. You will support the Threat Monitoring function through content creation and analysis, focusing on cyber threats and incident response. The position requires significant experience with SIEM technologies, malware analysis, and developing countermeasures. This role offers a competitive salary and comprehensive benefits as part of a thoughtful total rewards program.

Benefits

Competitive salary

Quality benefits program

Variable incentives and bonuses

Qualifications

• 4+ years of experience in Information Security.
• Familiarity with event triage and analysis methods.
• Understanding of malware attack paths and behaviors.

Responsibilities

• Support the technical analysis of SIEM alerts and content creation.
• Investigate SIEM/SOAR events for incident response.
• Identify automation opportunities to streamline triage processes.

Skills

Malware Analysis

Cyber Security Operations

Incident Response

Threat Monitoring

Security Information Event Management (SIEM)

Security Orchestration Automation & Response (SOAR)

Phishing mitigation

Education

Bachelor's Degree in Information Security

High School Diploma or GED with 8 years of experience

Tools

Splunk

Splunk Enterprise Security

Job description

Overview

This is a remote role that may be hired in several markets across the United States.

Three 12 hour shifts over the weekend and one 4 hour shift during the week. The weekday shift to be discussed with candidate to find a suitable time for their schedule and our needs.

Seeking an experienced security event telemetry triage Analyst. This is a technical role supporting the Threat Monitoring function with content creation and threat analysis. Candidates who have worked in a Security Operations Center in the past with experience in understanding network, host, and application security telemetry are preferred.

Daily Cadence

• Support the technical analysis of SIEM alerts as requested by the triage team.
• Support the content creation pipeline for new threats identified as a result of an incident, threat intelligence, or vulnerability.
• Identify any technology gaps and contribute to designing solutions to address them.
• Support the automation effort to streamline and accelerate triage response.

Responsibilities

• Event Triage and Analysis –investigate SIEM/SOAR events as necessary; bring experience in malware analysis, network/endpoint security to respond and contain incidents.
• Content Development - Support the creation countermeasures and mitigations in response to an incident or threat actor technique.
• Threat Hunting- Support the operational driven inputs (eg. on the heels of an incident or event) into threat hunting and help build countermeasures/mitigations to detect commodity and targeted threats.
• Automation - Identify areas for automation and facilitate the creation of automation use cases and support their implementation.

Qualifications

Bachelor's Degree and 4 years of experience in Information security OR High School Diploma or GED and 8 years of experience in Information security

Preferred Qualifications:

• Familiarity with event triage and analysis methods, building containment and mitigation strategies, and executing them at speed is a must.
• Understanding malware attack paths, its associated artefacts on disk and memory and its use of legitimate applications to hide behaviors will be useful.
• Familiarity with malware behaviors or hands on malware analysis would be a plus.
• Familiarity with exploit writing and as a consequence understanding application behaviors would be useful.

Preferred Skills: • Splunk • Splunk Enterprise Security • Security Information Event Management (SIEM) • Incident Response • Malware Analysis • Forensics • Threat Monitoring • Cyber Security Operations • Cyber Threat Response • Cyber Threat Hunting • Cyber Investigation • Alarm triage • Security Orchestration Automation & Response (SOAR) • Phishing analysis • Phishing mitigation • MITRE ATT&CK Matrix Kill Chain

The base pay for this position is generally between $110,000 and $140,000. Actual starting base pay will be determined based on skills, experience, location, and other non-discriminatory factors permitted by law. For some roles, total compensation may also include variable incentives, bonuses, benefits, and/or other awards as outlined in the offer of employment.

This job posting is expected to remain active for 30 days from the initial posting date listed above. If it is necessary to extend this deadline, the posting will remain active as appropriate. Job postings may come down early due to business need or a high volume of applicants.

Benefits are an integral part of total rewards and First Citizens Bank is committed to providing a competitive, thoughtfully designed and quality benefits program to meet the needs of our associates. More information can be found at https://jobs.firstcitizens.com/benefits.