security System AdministratorKMC Solutions, Inc.

Functional overview ?
A WorldWide leading Automotive Retail & Distributor is setting up a Security Platform as a centralized function within an organization employing people, processes, and technology to continuously monitor and improve an organization's security posture while preventing, detecting, analyzing, and responding to cybersecurity incidents. ?
Duties and responsibilities ?
SECURITY SYSTEMS ADMINISTRATOR ?
? * Maintain and manage border security systems, such as intrusion detection systems and firewalls. They support, monitor, and take care of existing configuration changes for Security Systems.
? * The administrator is conversant with procedures, such as change management, automation, and revision control. They need to configure and deploy security operating platforms and maintain it.
? * Administrator coordinates, schedule, and conduct hardware and software enhancements, upgrades, reconfigurations, and patches. They coordinate with engineering and business units to deploy and implement best practices to meet the objectives of the organization.
? * Install and configure Security hardware operating systems and applications. Apply patches & fixes
? * Security tooling operation and administration
? * Lead the implementation and maintenance of security tools that provide insight in to Company's security environment. The Security Administrator will monitor alerts and investigate security events via Company tooling to investigate suspicious activities; leading containment and prevention, as well as supporting recovery.
? * Engineers aid in fixing network security issues of our infrastructure, suggest recommendations after researching best industry practices, creating documents for its configuration and installation.
? * Review client requirements for security systems and collaborate with other engineers and developers to decide on an overall technical approach
? ?
?
INCIDENT RESPONSE & RECOVERY ?
? * Responsible for Incident Response work that includes identifying attack vectors, providing malware removal strategies, backup and restoration strategy, identifying IOCs, and compromised host isolation techniques.
? * Responsible for Malware analytics & vulnerability assessments that assist in identifying and mitigating MiTM, Ransomware, and Heartbleed attacks, as well as perform vulnerability scans and penetration testing.
? * Assists with ACL recommendations and router/switch/firewall configurations.
? * Response to alerts from information security tools & reports, investigates and resolves security incidents.
? * The Security Analyst Tier 2 is responsible to educate and communicate security requirements and procedures to all users and new employees.
? * Identifying & coordination the information security incident process, including investigating or working with relevant teams to deal with the incidents, identify the root cause and amend policies when required
? * Document all incidents and create a clear narrative that supports their conclusions
? * Assist with the preparation of incident Reports
? * Utilize tools (e.g., Wireshark, Nmap, PCap, etc.) to identify and map devices on the network
? * Interface with field personnel to mitigate security incidents
? * Serve as the technical escalation point and mentor for lower-level analysts
? * Maintain detailed notes within Operational Management systems on all security issue resolution activities
? * Regularly communicate with customer IT teams to inform them of issues, help them remediate, and ensure that they continue to operate business as usual
? * Ensure that all Security Platform tickets are handled and resolved within SLAs (Service Level Agreements).
? ?
THREAT ANALYSIS ?
? * Monitor and analyse security events and alerts from multiple sources, including security information and event management software, network and host-based intrusion detection systems, firewall logs, and system logs (Windows and Unix), and databases
? * Separate true threats from false positives using network and log analysis and escalate possible intrusions and attacks
? * Researches security trends, new methods, and techniques used in unauthorized access of data in order to pre-emptively eliminate the possibility of system breach
? * Receive and analyse network alerts from various sources within the enterprise and determine possible causes of such alerts
? * Maintain a strong awareness of the current threat landscape.
? ? ?
INVESTIGATION & TRIAGING ?
? * Perform triage of incoming issues (assess the priority, determine risk).
? * Coordinate with enterprise-wide cyber defense staff to correlate threat assessment data and validate network alerts
? * Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
? * Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
? * The Security Analyst, Senior recommends and implements changes to enhance systems security and prevent unauthorized access.
? * Open, track and close trouble tickets
? ?
Minimum qualifications ?
? * 4+ year of experience working in a NOC or SOC as System Administrator
? * 4+ year of Security Incident Response experience
? * 4+ years of networking and/or security experience
? * 2+ years of experience in Security Management and SIEM (e.g., Splunk, OSSIM, AlienVault)
? * 2+ years of experience with Ticket Management Tools (e.g., ManageEngine)
? * Possession of Industry Certifications (Security+, SSCP. GCIA, CISSP)
? * 2+ year of experience of event/alert management, incident and change management processes.
? * 2+ year of experience of Command and Control (CnC), Indicator of Compromise (IoC), DDOS, Email Phishing, Brute Force Attacks, Event log analysis
? * Knowledge of and experience with intrusion detection/prevention systems and security software
? * Strong knowledge and understanding of network protocols and devices.
? * Strong experience with Windows, and Unix systems.
? * Proficiency in Microsoft Office programs and ability to learn specialized system tools
? * Ability to analyse event logs and recognize signs of cyber intrusions/attacks
? * Preferred but not required:
? * Experience in network/host vulnerability analysis, intrusion analysis, digital forensics, penetration testing, or related areas
? * Qualifications such as CISSP, Security +, Network +, CEH, RHCA, RHCE, MCSA, MCP, MCSE and knowledge of NISP /equivalent industry standard is preferred
? * Familiarity with tools such as Cyciv, Sentinel One, ProofPoint, Netskope, Intruder, ManageEngine, Security ScoreCards, Last Pass
? ?
Education: ?
? * Minimum bachelors' degree in Information Security, Computer Science, or other IT-related field. Exceptional candidates with proven experience in security/network operations will also be considered.
?
Please refer to the job description.
Bossjob

Pasig City, Metro Manila
Permanent
Full-time