Security clearance: Must have Negative Vetting Level 1 Security Clearance.
This role requires in-depth knowledge of cyber security fundamentals to accurately determine impact and relevance of emerging and existing threats to operating environments. The CTD SIEM Specialist will draw upon their knowledge of detection methodologies and technologies, attack vectors, vulnerability management principles, network security, security engineering principles, information systems control design and control monitoring.
Key duties may include, but are not limited to: Threat Detection development inclusive of reviewing and approving detection use cases, response playbook development and implementation of detection use cases. Provide technical or strategic advice on complex issues related to detection technologies. Coordinate the accurate and appropriate referral and subsequent tuning of detection use cases. Review and contribute to process documentation including providing input into the development of processes and ensuring documentation created by the shift aligns with outcomes and goals of the process. Provide timely, relevant and accurate information to the Director Cyber Threat Detection where business impacts of events and decisions are sensitive, including but not limited to: wide ranging impacts, events affecting senior executives or other agencies, and confidentiality, integrity, and availability impacts. Provide technical guidance and support to Cyber Security Operations staff while overseeing Cyber Threat Detection roles. Prioritise tasks and duties in accordance with direction from Cyber Security Divisional teams considering risk, urgency, and impact using independent judgement. Provide expert advice and assistance to team members performing technical work. Selection Criteria Proficiency in managing SIEM platforms – QRadar, Splunk and Elastic. Knowledge of network architecture concepts including topology, protocols, components, and principles. Experience in developing SIEM use cases and/or rules. Understanding of the requirements of network security monitoring. Must possess strong verbal and written communication skills. Understanding of Windows and Unix/Linux logging. Familiarity with the MITRE ATT&CK Framework. #J-18808-Ljbffr