Sr. Specialist DDIT ISC Detection & Response

Overview

Entry-level Detection and Response Analyst role in Novartis's Cyber Security Operations Center (CSOC), focused on detecting, investigating and mitigating threats across Novartis IT networks, systems, users and applications.

What you'll do

• Monitor security controls and consoles from across the Novartis IT ecosystem in real time.
• Communicate with technical and non-technical end users who report suspicious activity.
• Conduct initial investigations into security incidents involving a variety of threats.
• Gather live evidence from endpoint devices and log sources across systems and applications.
• Support incident response activities including scoping, communication, reporting and long-term remediation planning.
• Prepare technical reports for business stakeholders and IT leadership.
• Use SIEM/big data to identify abnormal activity and extract meaningful insights.
• Research, develop and enhance content within SIEM and other tools.
• Interface with engineering teams to design, test and implement playbooks, orchestration workflows and automations.
• Research and test new technologies and platforms; develop recommendations and improvement plans.
• Perform host-based analysis, artifact analysis, network packet analysis and malware analysis in support of investigations and incident response.
• Coordinate investigation, containment and other response activities with business stakeholders and groups.
• Develop and maintain documentation, including response playbooks, processes and other operational material.
• Perform quality assurance review of analyst investigations and work product; develop feedback and development reports.
• Mentor junior staff and serve as point of escalation for higher severity incidents.
• Develop incident analysis and findings reports for management, including gap identification and recommendations for improvement.
• Recommend or develop new detection logic and tune existing sensors and security controls.
• Work with security solution owners to assess the ability of existing security solutions to detect and mitigate relevant TTPs.
• Create custom SIEM queries and dashboards to support monitoring and detection of advanced TTPs against the Novartis network.

What you'll need

• University working and thinking level; degree in a business, technical or scientific area, or comparable education/experience.
• Experience in IT administration with technical, analytical and conceptual skills.
• Experience reporting to and communicating with technical and non-technical business stakeholders.
• Excellent written and verbal communication and presentation skills; interpersonal and collaborative skills; ability to communicate information risk-related and incident response concepts to technical and non-technical audiences.
• Understanding and knowledge of general IT infrastructure technology and systems.

Nice to have

• 2+ years of experience in an Information Technology or analytical role.
• Professional information security certification such as CISSP, CISM or ISO 27001 auditor/practitioner.
• Professional (information system) risk or audit certification such as CIA, CISA or CRISC.
• Willingness for required travel and flexible work hours.

Details

• Location: Hyderabad (Office).
• Part of a global organization; flexible work hours and travel are expected.