Security Officer performing patrols, emergency response, and customer service at Climax Molybdenum. Managing site security and assisting with emergency situations at various locations.
About the role
- Cybersecurity Incident Responder in Datacom's CSIRT team investigating major incidents and conducting digital forensics. Collaborating with stakeholders and providing proactive response services.
Responsibilities
- Conduct thorough investigations into major security incidents, determining root causes, impact, and mitigation strategies. Providing expertise and support to contain, eradicate, and recover from such security incidents.
- Conduct analysis of affected systems utilising forensic techniques to thoroughly examine system events and adversary activities.
- Utilise security tooling such as EDR, SIEM, XDR, & Identity technologies to assist your investigation of confirmed or suspected compromises.
- Undertake log & correlation analysis and construct a timeline of adversary activities.
- Identify intrusion vectors & root causes and develop recommendation actions to prevent similar incidents.
- Collect digital forensics evidence from affected systems in accordance with industry standards for image acquisition and preservation of digital evidence.
- Produce comprehensive, detailed DFIR reports outlining the investigative steps undertaken, your findings, and recommendations.
- Support the coordination of containment, eradication and recovery efforts based on available information and established processes.
- Analysis of incident response effort, with feedback from the customer and third parties as part of Post Incident Reviews (PIRs) and Lessons Learned.
- Deliver proactive incident response services which include tabletop exercises, threat hunting, compromise assessments, breach readiness assessments, threat intelligence briefings, and threat modelling.
- Communicate with senior stakeholders within Datacom and our customers.
- Work with other members of the CSIRT team, to develop the technical capabilities of the CSIRT - including improving the processes and technology to deliver successful outcomes to customers and stakeholders.
- Participate in an on-call roster for major incident response.
- Occasional planned or last-minute/urgent travel to customer sites will be required for certain customer facing engagements. This may include a customer site in your home city, or travel to other customer sites within Australia and New Zealand.
Requirements
- The mindset of an investigator. We are looking for someone who is able to search for evidence of compromise and previously undetected adversary behaviour.
- Confidence in communicating with a variety of senior stakeholders, including Senior Leadership teams in difficult / tense situations.
- Experience in responding to high-profile cybersecurity incidents that have had significant operational or privacy impacts to the affected organisation such as ransomware & data breaches.
- Experience in digital forensics & incident response (DFIR) with an understanding of key system & digital forensic artifacts and how they are useful in a cybersecurity investigation.
- Experience using DFIR tools such as EnCase, X-Ways, Magnet Axiom, Velociraptor, KAPE, & THOR.
- Proven knowledge and experience of efficiently searching large datasets across multiple log sources and underlying platforms including XDR/EDR and SIEM products such as CrowdStrike, Microsoft Defender, Splunk, or Sentinel.
- A strong understanding of current and emerging attacker behaviours, tools, tactics, and techniques.
- An understanding of various security frameworks and methodologies such as NIST CSF, MITRE ATT&CK and D3FEND, Unified Kill Chain and OWASP Top 10.
- Basic scripting or automation skills are desirable (for example PowerShell, Bash, Python, or Ruby).
- SANS GCFA, GCFE, GCIH, or relevant DFIR certifications are desirable.
Job title
Job type
Experience level
Salary
Not specified
Degree requirement
Tech skills
Location requirements
Security Officer leading safety inspections and facility patrols at Crown Equipment Corporation. Assigning duties and responding to security incidents efficiently.
Security Officer overseeing safety inspections and personnel training for Crown Equipment Corporation. Responsible for monitoring facilities and responding to security incidents.
Manager of Security Risk at Grainger overseeing Information Security Risk team and managing security risk programs. Focused on regulatory compliance, leadership, and risk assessment integration.
SAP Security GRC Consultant involved in designing and implementing security architectures for Swiss clients. Collaborating with project teams on compliance and security solutions.
Senior Consultant with Wavestone providing SAP Security and IAM solutions in Switzerland. Collaborating on security architectures and supporting clients on SAP security transformations.
Network Security Engineer ensuring secure, highly available enterprise network systems with a focus on collaboration and technical excellence. Involves designing and implementing networking solutions.
Security Manager at Leonardo focusing on cyber compliance and risk management across OT and IT frameworks. Supporting clients in strategic initiatives and infrastructure assessments.
Senior Analyst leading cybersecurity governance initiatives at Elsevier. Developing and maturing governance programs for data protection and risk management across the organization.
Commercial Security Service Sales Executive promoting and selling security services at Johnson Controls. Building relationships and delivering solutions to protect people and property within assigned territories.