Senior Specialist Information Security Analyst (SOC)
Bank of New York Mellon is a global financial services company focused on helping clients manage and service their financial assets, operating in 35 countries and serving more than 100 markets. BNY Mellon is a leading provider of financial services for institutions, corporations and high-net-worth individuals, providing superior asset management and wealth management, asset servicing, issuer services, clearing services and treasury services through a worldwide client-focused team.
As a Senior Cyber Threat Analyst, you will be given the opportunity to join a team of security analysts about both traditional and unconventional ways to detect, analyze, and mitigate potential intrusions and other security incidents. The candidate will join a follow the sun team currently responsible for providing investigative response for security events including but not limited to intrusion detection, malware infections, denial of service attacks, privileged account misuse and network breaches.
Candidates must be willing to work in a SOC environment, demonstrate strong problem solving skills, have demonstrable experience in various toolsets and best practices, able to critically think, and allow for flexible scheduling. Responsibilities:
- Collects, analyzes, and enriches event information and perform threat or target analysis duties.
- Interprets, analyzes, and reports all events and anomalies in accordance with Computer Network Directives, including initiating, responding, and reporting discovered events.
- Manages and executes multi-level responses and addresses reported or detected incidents.
- Providing reporting and metrics around security monitoring by designing dashboards for asset owners and management consumption.
- Coordinates and distributes directives, vulnerability, and threat advisories to identified consumers.
- Develops focused reporting and briefings for advanced cyber threats and activity to various teams and leaders.
- Provides correlation and trending of Program's cyber incident activity.
- Create AARs and document TTPs, with the ability to do deep dive investigations on complex incidents.
- Improve the service level for security operations and monitoring. Creating and maintaining system documentation for security event processing.
- Author Standard Operating Procedures (SOPs) and training documentation.
- Act a SME and trainer to T2 and T1 personal as needed.
BNY Mellon is an Equal Employment Opportunity Employer. Our ambition is to build the best global team - one that is representative and inclusive of the diverse talent, clients and communities we work with and serve - and to empower our team to do their best work. We support wellbeing and a balanced life, and offer a range of family-friendly, inclusive employment policies and employee forums. Primary Location:
- Bachelor'sDegree in a technical discipline with a minimum of 8 years related technicalexperience is required for a level 3 role. An additional 2 years ofexperience may be substituted in lieu of a degree.
- Musthave at least two (2) certifications, from a respectable security organization(e.g. based on U.S. DOD8570 standard)
- Backgroundin hands on computer and networking experience to include an understanding ofTCP/IP, routing, and major Internet protocols.
- Understandingof network, desktop and server technologies, including experience with networkintrusion methods, network containment, segregation techniques and technologiessuch as Intrusion Detection Systems (IDS) and Intrusion Protection Systems(IPS).
- 5+years Intrusion monitoring, incident response and mitigation, web applicationsecurity, threat research, pen testing or intelligence analysis.
- Abilityto read and write scripts in various languages. (php, ksh, python, powershell,SQL, and or similar)
- 5+years using Splunk, ArcSight and/or similar SEIM experience.
- Candidatesmust be willing to work in an on-call situation as well as needed per rotation.
- Strongverbal and written communication skills, including the ability to providetechnical thought leadership on security incident investigation calls withother technology teams, and the ability to translate complex technical conceptsinto plain English for consumption by non-technical audiences.
- Abilityto thrive in ambiguity on situations and have attention to detail.
- Self-motivatedand able to work in an independent manner.
- Experienceand proficiency in a various security tool sets and best practices.
Information Technology Internal Jobcode:
Information Security-HR11724 Requisition Number: