VP, Enterprise Cybersecurity Engineering

Senior Analyst, Threat Detection and Response

Senior Consultant, Core Cyber Ops

Role Description: <ul><li>Youll be empowered to be at the top of your game by providing strategic partnership, and innovative technology solutions that supports our client vision of being a tech-driven, global, long-term investment firm.</li></ul> Responsibilities: What will you do as an VP, Enterprise Cybersecurity Engineering, Cybersecurity Platform Engineer? <ul><li>Identify and recommend improvement areas in existing enterprise security architecture to address evolving cybersecurity threats</li><li>Align and balance business requirements with cybersecurity, information, and technology requirements, based on the organization’s risk appetite</li><li>Evaluate, perform proof-of-value/proof-of-concept, design, build and implement enterprise-class cybersecurity systems</li><li>Develop integrated security operating models and documentations to ensure operational efficiency, scalability, and sustainability</li><li>Act as a domain expert and trusted partner in Cyber Security &amp; Resilience; work closely with stakeholders in Technology Group and other business groups on cybersecurity engineering related matters</li></ul> Requirements: What qualifications or skills should you possess in this role?&nbsp; <ul><li>Bachelor’s degree in Information Technology, Computer Science, or a related discipline.</li><li>At least 10 years of relevant experience preferably in financial services or asset management industries, with minimum 7 years in Cyber Security or Information Security.</li><li>Proven experience in implementing and operationalizing enterprise cybersecurity platforms, including:</li><li>Security Operations Tooling: EDR, NDR, SIEM, SOAR, XDR, Threat Intelligence Platforms (TIPs).</li><li>Email Security: Secure email gateways (SEG) and Integrated Cloud Email Security (ICES), anti-phishing and anti-malware controls, DMARC/DKIM/SPF authentication, and email threat detection and response.</li><li>Continuous Threat Exposure Management (CTEM): Attack surface assessment, vulnerability assessment, data aggregation and risk-based prioritization, threat exposure management, and attack simulation/validation (e.g., BAS).</li><li>Experience operationalizing a CTEM program or equivalent risk-based exposure management framework preferred.</li><li>Working knowledge of cloud security controls and reference architectures across AWS, Azure, and Google Cloud Platform.</li><li>Scripting and coding skills, with proficiency in Java, Python, C#, or similar programming languages, and good understanding of REST API’s and JSON.</li><li>Ability to produce detailed documentation, including design diagrams and process flows.</li><li>Must be meticulous, versatile, and inquisitive, having strong attention to detail with an analytical mind and outstanding problem-solving skills.</li><li>Desire to learn, working in a diverse environment, interacting with multiple teams and functions to support strategic goals. Be a good team player and excellent communicator.</li><li>Professional qualification in information security, such as CISSP / CISM / CEH will be advantageous.</li></ul>

Responsibilities: <ul><li>Continuously monitor security consoles and dashboards (SIEM, EDR, etc.) for suspicious activity; triage alerts to identify valid security incidents versus false positives and prioritize response based on asset criticality and business risk.</li><li>Investigate suspicious activities and security events, determine the scope and severity of incidents, and gather relevant evidence. Perform root cause analysis to identify attack vectors and affected systems.</li><li>Execute incident response actions end-to-end – including timely containment of threats, eradication of malicious artifacts, and system recovery – following the organization’s incident response plan. Coordinate with IT infrastructure, application owners, and other stakeholders to ensure effective remediation of incidents.</li><li>Proactively hunt for indicators of compromise and hidden threats in logs, network traffic, and endpoint telemetry, even without specific alerts. Use hypothesis-driven techniques and knowledge of attacker TTPs to uncover stealthy or emerging threats that evaded initial detection.</li><li>Continuously tune SIEM/EDR detection rules, thresholds, and SOAR playbooks—automating repetitive response actions to reduce false positives and accelerate containment</li><li>Leverage internal and external threat intelligence sources to enrich analysis and response. Stay updated on new vulnerabilities and adversary tactics; incorporate this knowledge to adjust monitoring rules and incident response strategies. Map observed malicious activities to frameworks like MITRE ATT&amp;CK for reporting and analysis.</li><li>Work closely with global SOC team members and escalate complex incidents to senior analysts or incident response leads when necessary. Collaborate with colleagues in other regions to ensure seamless coverage and knowledge sharing across the security team.</li><li>Document investigation steps, findings, and actions taken for each incident in a clear and concise manner. Prepare incident reports and contribute to post-incident review meetings, highlighting what occurred, how it was resolved, and recommendations to prevent future occurrences.</li><li>Assist in developing and updating incident response playbooks, standard operating procedures, and knowledge base documentation. Provide feedback and suggestions to improve security monitoring tools, analytics content (detection rules), and workflow automation (SOAR playbooks) for greater efficiency and effectiveness.</li><li>Share insights from incidents and trending threats with the broader team to enhance overall awareness. Mentor and guide junior analysts (Tier 1 SOC analysts) by sharing analysis techniques and best practices, elevating the team’s collective skill level.</li></ul> Requirements: <ul><li>Bachelor’s degree in Cybersecurity, Computer Science, Information Systems, or equivalent threat management &amp; incident response experience</li><li>Currently hold cybersecurity certifications such as GCIH, GCFA, GCIA, CEH, others</li><li>With 3 years or more, progressive experience in at least two of the following disciplines:</li><li>Threat Detection &amp; Analysis (leveraging SIEM tools, IDS/IPS, endpoint detection, log analysis, etc.)</li><li>Incident Response &amp; Management (developing response plans, executing playbooks, forensic investigations, root cause analysis)</li><li>Threat Hunting (identifying undetected threats through proactive analysis and hypothesis-driven investigation)</li><li>Cyber Threat Intelligence (gathering and analyzing threat intelligence to inform detection capabilities and preventive measures)</li><li>Network Security (TCP/IP protocols, firewalls, intrusion prevention systems, and network traffic analysis)</li><li>Securing and monitoring operating system and cloud environments (AWS, Azure, GCP), including analyzing cloud service logs and configurations for suspicious activities, and understanding cloud-native security controls and best practices</li><li>Demonstrated ability to:</li><li>Function as a Level 2 or 3 SOC Analyst (analyzing and responding to cybersecurity incidents)</li><li>Preferred Experience:</li><li>Experience with SOAR tools and some proficiency in scripting languages (e.g., Python, PowerShell) to automate repetitive tasks and streamline incident response workflows</li><li>Advanced understanding of emerging threats, zero-day vulnerabilities, and common attack vectors (phishing, malware, ransomware, lateral movement) with the ability to ensure rapid detection and response</li><li>Hands-on experience using SIEM and EDR platforms for centralized log analysis, real-time threat monitoring, and in-depth incident investigations</li><li>In-depth knowledge of the incident response lifecycle</li><li>Proven ability to conduct proactive threat hunting operations, leveraging the MITRE ATT&amp;CK framework to map adversary tactics, techniques, and procedures (TTPs), uncover stealthy threats, and close gaps in detection coverage</li><li>Familiarity with cyber threat intelligence feeds and standards (e.g., STIX, TAXII), incorporating IOCs (Indicators of Compromise) and threat intel data into monitoring and investigations to enrich context and anticipate emerging threats</li><li>Understanding of key security frameworks and regulations (e.g., NIST CSF, ISO 27001, GDPR) and the ability to align threat detection and incident response processes with organizational policies and compliance requirements</li><li>Effective at coordinating with cross-functional teams (IT, DevOps, Business, etc.) during high-impact incidents and translating complex technical findings into clear, actionable insights for executive and non-technical stakeholders</li></ul>

Responsibilities: Incident Response: <ul><li>Lead the response to a wide range of cybersecurity incidents. Conduct in-depth investigations, validate incidents, and drive containment efforts based on escalations from SOC analysts.&nbsp;</li><li>Follow established protocols and document findings thoroughly.</li></ul> Security Monitoring: <ul><li>Design, implement, and manage solutions to enhance incident response processes. Continuously monitor security alerts and events using SIEM tools to identify potential threats.&nbsp;</li><li>Analyze logs and network traffic to detect anomalies and suspicious activities.</li></ul> Log Analysis: <ul><li>Perform detailed analysis of logs from multiple sources (e.g., EDR, firewalls, IDS/IPS, servers) to identify and investigate security incidents.</li></ul> Threat Intelligence: <ul><li>Leverage threat intelligence feeds to stay informed about emerging threats.&nbsp;</li><li>Apply insights to improve detection capabilities and strengthen response strategies.</li></ul> Documentation: <ul><li>Document security incidents comprehensively, including actions taken and outcomes.&nbsp;</li><li>Develop and maintain process documentation to ensure consistent and efficient security operations.</li></ul> Incident Response Leadership: <ul><li>Lead and guide incident detection, response, and recovery processes to ensure effective and efficient management of cybersecurity incidents.</li></ul> Cyber Services Visibility: <ul><li>Oversee the design and operation of systems that provide situational visibility across all cyber services, including foundational analytics and automation.</li></ul> Third-Party Compromise Management: <ul><li>Build and maintain partnerships to address and mitigate risks associated with third-party compromises.</li></ul> Requirements: <ul><li>Minimum of 6 years of relevant work experience (typically 8+ years preferred).</li><li>Strong knowledge of cybersecurity principles, threat detection, and incident response.</li><li>Proven experience in Incident Response (IR).</li></ul>

Skills

Industry

Location

Jobtitle

3 edr Jobs found

VP, Enterprise Cybersecurity Engineering

Senior Analyst, Threat Detection and Response

Senior Consultant, Core Cyber Ops

WhiteCrow
WhiteCrow is on a mission to connect companies with the best talent across the globe.

EMPLOYER

TALENT

COMPANY

Contact Us

JOBS BY SKILLS

JOBS BY FUNCTION

JOBS BY INDUSTRY

JOBS BY LOCATIONS

MODEL JOBS

JOBS BY CITY

Skills

Industry

Location

Jobtitle

3 edr Jobs found

VP, Enterprise Cybersecurity Engineering

Senior Analyst, Threat Detection and Response

Senior Consultant, Core Cyber Ops

WhiteCrow WhiteCrow is on a mission to connect companies with the best talent across the globe.

EMPLOYER

TALENT

COMPANY

Contact Us

JOBS BY SKILLS

JOBS BY FUNCTION

JOBS BY INDUSTRY

JOBS BY LOCATIONS

MODEL JOBS

JOBS BY CITY

WhiteCrow
WhiteCrow is on a mission to connect companies with the best talent across the globe.