Security Monitoring Content Author

Security Monitoring Content Author

The department supports IT and Business Units to develop adequate solutions in Information Security and Risk Management practices.

Their mission is:

- to enable sound and formal information security risk decision making
- to help management with implementing a proper information security management system.

They commit to deliver upon four objectives:

1) enable the extended enterprise;

2) Counter cybercrime;

3) Protect information systems;

4) Manage security risks.

Consequently, the vision of the team is to support Counter cybercrime objective by demonstrably best in class' preparation and response to unauthorized cyber activity.

This is done by providing the following services:

Proactive

- - support & intelligence to help prepare and secure bank systems in anticipation of cyber-attacks.

Reactive

- triggered by a request/incident/event identified by an intrusion detection system or reported by human.

Main goal of Security Monitoring project is to ensure detection of all security threats targeting the company.

Responsibilities and main tasks:

- Create and define new use cases and scenarios based on requests and experience.
- Support operational teams with their content requirements to speed up analysis and alert treatment.
- Coordinate and deploy new content in production and development environments, including log data integration.
- Continuously improve and update existing content to increase the quality, efficiency and effectiveness of the use cases.
- Create test plans for new content, document and execute them.
- Write and maintain technical use case documentation and guidelines for log source integration and base lining.
- Oversee log data quality, contextualization and asset modelling.
- Create and maintain flex connectors, plug ins, scripts,
- Design and implement automated and manual reporting.
- Guidance, oversight and quality assurance on the event/data source integration.
- Manage/Coordinate relationships, projects, and open issues with vendor support, Professional Services staff, and internal teams related to content and report life cycle management.
- Participate and/or lead efforts towards improving the existing process and procedures supporting content and report life cycle management. 
- Without doubt your involvement in other topics/activities related to security monitoring will be instrumental and appreciated.

Experience

- 5 years of experience within the IT domain with 3+ years of specialization in security analytics, monitoring, cyber defence & detection, 2 years (or more) of proven experience in content authoring
- A solid and proven expertise in SIEM solutions, based on ArcSight and other technologies.
- 2 years (or more) of proven experience in content authoring.
- A strong vision and holistic view on what it takes to perform effective and efficient security monitoring
- Ability to dive into deep technical matters without losing track of the bigger picture
- Solid understanding of network and security monitoring architecture
- 5 years of experience within the IT domain with 3+ years of specialization in security analytics, monitoring, cyber defence & detection