Information Security Analyst III

Southern New Hampshire University is a people-centered university focused on transforming lives through education. The Information Security Analyst III serves as the senior lead for the Security Operations Center, monitoring the enterprise technology ecosystem, investigating security events, and responding to incidents. The role also leads detection engineering, security operations engineering, vulnerability management, and risk remediation activities.

Responsibilities:

• Act as the senior escalation point for security alerts and incidents triaged by level I and II analysts
• Act as Incident Coordinator in alignment with SNHU's Information Security Incident Response Plan
• Act as technical lead for investigation of complex or high severity security threats or incidents
• Lead, define, and authorize incident containment and eradication activities like endpoint isolation, malware remediation, forensic analysis, malware analysis, community member interviews, and network traffic analysis
• Understand the incident response lifecycle and possess the analytical mindset needed when it comes to escalated investigations and investigation into novel security incidents
• Work cross-functionally across ITS and all SNHU business units to provide support, guidance, and technical implementations where appropriate, to include triage, containment, and remediation when applicable
• Analyze digital evidence to identify indicators of compromise, adversary activity, root cause, incident timelines, and attack vector(s)
• Remain calm and function at the highest level during a crisis
• Develop SIEM alerts, reports, and dashboard content to enhance detection coverage and increase the efficiency and effectiveness of level I and II analysts
• Partner with other ITS and business partners to develop and maintain monitoring content relevant to their use cases related to academic integrity investigations, financial aid fraud, and system/network administration
• Analyze, implement, and approve tuning of alert content and security tools
• Remain up to date on emerging threat intelligence
• Serves as the Security Operations technical lead for ITS and enterprise-wide projects
• Develop strategies and solutions that remediate or mitigate the risks associated with threats identified during the incident response process and other programs such as vulnerability management, threat intelligence, and risk management
• Identify, prioritize, and onboard log data pertinent for monitoring SNHU's complex, virtualized, multi-site computing environment and expansive technology ecosystem
• Develop and implement logging baselines for operating systems, software applications, network infrastructure, cloud-based resources, security tools, and other technology resources
• Develop and implement data pipelines for log data, ensuring compliance with log retention requirements while increasing SIEM efficiency
• Implement, configure, deploy, and manage security operations tools (e.g. Splunk, Cribl, Halcyon, Microsoft Defender XDR, Tenable)
• Develop and maintain automation scripts and other tools to enhance security operations efficiency and effectiveness
• Enforce vulnerability remediation compliance standards
• Review and process false positive detections reported by remediation owners
• Perform risk analyses on software vulnerabilities and prioritize vulnerability remediation efforts
• Provide technical vulnerability remediation assistance to resource owners
• Generate and provide regular reporting to management on key Security Operations metrics related to incident response, continuous monitoring, and vulnerability management
• Excel at documentation and detailed notetaking, including SOP writing, incident reporting, e-mail and instant messaging etiquette, and most importantly, documenting incident actions appropriately
• Communicate with stakeholders, in a non-technical manner, at all organizational levels as part of incident response and remediation activities
• Provide customer support in alignment with SNHU's Core Values and understand how and when to appropriately escalate potential issues
• Other duties and responsibilities as assigned. Job duties and responsibilities can change at any time, with or without notice

Requirements:

• 5+ Years of relevant or specific experience: in cybersecurity
• 4 + years working in a security operations center (SOC), a cybersecurity operations center or on a cybersecurity incident response team, and a minimum one year working in a mid to senior level in this capacity
• Bachelor's degree in cybersecurity, information technology, data analytics, information assurance, computer science, or related field
• Equivalent of experience in lieu of degree acceptable
• ISC2 CISSP; ISACA CISM or CISA; CompTIA CySA+, Security+, Network+, Microsoft AZ-900, SC-100, SC-200; SANS GIAC certifications such as GSEC, GCIH, and GSOC; and EC Council CEH, CPENT, and CIH
• Experience collecting, organizing, and analyzing data gathered from firewalls, vulnerability scanners, Windows/Linux operating systems, software application logs, Azure cloud-resources, email platforms, Endpoint Detection and Response (EDR) tools, and other platforms in the environment that enable enterprise-wide security monitoring
• Experience implementing, writing, deploying, and maintaining scripts used for security operations automation