About the opportunity
A leading financial services organisation is looking for an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.
You'll work in a high-performing security team, ideally using Splunk and your knowledge of current attack techniques to detect, investigate and respond to threats across web applications, networks and endpoints.
What you'll do
- Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity
- Use Splunk (or any other SIEM tool) to investigate security events, and build macros, alerts and dashboards that surface targeted attacks
- Identify common exploits and attack patterns (OWASP Top 10 and beyond) from web and event logs
- Interpret Apache, IIS and Active Directory logs alongside other security data sources
- Detect anomalous or malicious network activity using advanced analytics and security tooling
- Support incident response, recommending and helping implement mitigations, including WAF and CDN security controls
- Interpret stateful firewall rules and contribute to security operations procedures and continuous improvement
About you
Essential
- Strong intrusion analysis background, with proven ability to interpret web and application logs from a security perspective
- Solid understanding of how web applications work under the hood, including HTTP/HTTPS, DNS and TLS
- Knowledge of common web application attack vectors and current exploits, including SQL injection, cross-site scripting and remote file inclusion
- Experience independently investigating issues end-to-end and incident response experience
- Comfortable with scripting languages and regular expressions
- Working knowledge of enterprise client/server architecture
- Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
- Experience with Web Application Firewalls (WAF)
- Experience with Akamai or other CDN security controls beneficial
If this sounds like you, and you are a Permanent Resident or an Australian citizen, please apply at the earliest with your resume! You can contact Urvi Thacker for any queries.
