cyber incident responder

Deloitte

<div>
 
 Cyber Security I Incident Response Senior Engineer
 
 
 ,
 
 
 Cairo. Egypt
 
 
 
 
 Connect to your career at Deloitte
 
 
 
 
 Deloitte
 
 
 ,
 
 established globally in 1845, is the world&rsquo;s largest and leading professional services firm, providing Audit &amp; Assurance, Tax &amp; Legal and Consulting and related services to public and private clients spanning multiple industries. Present in more than 150 countries, Deloitte is distinct in its ability to help clients solve their most complex problems, from strategy to implementation.
 
 
 Deloitte innovation hub (DIH) is a strategic initiative/priority established by Deloitte North &amp; South Europe (NSE) to support our ambition to become the leading business transformation partner of choice for our clients and to expand and scale our delivery footprint across EMEA. With access to a scaled, diverse, highly skilled, motivated, and engaged workforce, DIH is delivering complex technical solutions for clients&rsquo; most complex business problems, across Portfolios that include &lsquo;Strategy &amp; Transactions&rsquo;, &lsquo;Customer&rsquo;, &lsquo;Engineering, AI &amp; Data, &lsquo;Enterprise, Technology &amp; Performance&rsquo; and &lsquo;Cyber&rsquo;. DIH is aiming to become the destination for top talents in Egypt for a long, exciting career.
 
 
 We invest in outstanding people of diverse talents and backgrounds and empower them to achieve more than they could elsewhere. Our work combines advice with action and integrity. We believe that when our clients and society are stronger, so are we. Our organization has grown in scale and diversity, providing services across the region, with our shared culture remaining the same. We aim to help clients realize their ambitions, make a positive difference in society, and maximize the success of our people. This drive fuels the commitment and humanity that run deep through our every action.
 
 
 
 Connect to your opportunity.
 
 
 
 As a
 
 Digital Forensics
 
 
 Incident Response Senior Engineer
 
 
 ,
 
 you will be assisting clients with response to Cyber Incidents &amp; getting back to business, this includes data leaks, ransomware, unusual network traffic. Cyber criminals, from insider threat to nation-state sponsored hackers.
 
 
 
 Your Role Will Also Include The Following
 
 
 
 <ul>
 <li>
 Conduct analysis of log files, Windows event logs (Windows artifacts), and Linux artifacts to identify correlations using EDR, network monitoring tools, and SIEM platforms (e.g., Splunk, Microsoft Security Suite, and CrowdStrike Falcon). The role requires applying knowledge of forensic artifacts across various client platforms.
 </li>
 <li>
 Conduct in-depth analysis of malware, threat intelligence, and other relevant sources.
 </li>
 <li>
 Provide tactical support such as advice on triage, containment, eradication, and broader coordination during cyber incidents.
 </li>
 <li>
 Perform forensic analysis of systems and networks.
 </li>
 <li>
 Execute memory forensics.
 </li>
 <li>
 Perform Compromise Assessments and Threat Hunting projects in SIEM and EDR tooling.
 </li>
 <li>
 Create custom scripts (using Python) for parsing special log files, data sets, and images, etc.
 </li>
 <li>
 Create complex timelines based on findings and observations.
 </li>
 <li>
 Act as a member of the broader Deloitte Response Team, adding CIR skills to the overall team that includes privacy, crisis management, crisis communication, forensic investigations, and ICS/OT.
 </li>
 <li>
 Partake in the EMEA and Global technical incident responder community to build a strong network and share a knowledge base.
 </li>
 <li>
 Maintain flexible working hours to support the customer during high-impact incidents.
 
 
 </li>
 </ul>
 
 Connect To Your Skills And Professional Experience
 
 
 
 To succeed in this role, you need to have the following:
 
 
 <ul>
 <li>
 At least 3 years of experience in Cyber Incident Response and digital forensics, or similar response experiences in operational environments.
 </li>
 <li>
 Hands-on skills to perform sharp and in-depth analyzes, both using tooling such as EDR and network sensors, but also manual analysis, if the tools are not available.
 </li>
 <li>
 Broader experience in other technical areas of information security, such as penetration testing, threat intelligence or security operations, is beneficial.
 </li>
 <li>
 Experience in systems and/or network administration, engineering or architecture is a highly advantageous.
 </li>
 <li>
 Ability to work under pressure and keep track of the big picture while performing in-depth analysis.
 </li>
 <li>
 Ability to apply analytical insights at an organizational level, considering wider implications and threat actor attack paths and lifecycles.
 </li>
 <li>
 Relevant academic qualifications such as Master&rsquo;s or bachelor&rsquo;s degree in computer science, information security or related fields.
 </li>
 <li>
 Relevant industry qualifications to demonstrate understanding, for example CISSP, CISM, GCFE, GCFA, GREM, GCIH, CCIM, GCIA, CCNIA, CCHIA, CCMRE or similar
 
 
 </li>
 </ul>
 
 The Following Attributes Are Essential
 
 
 
 <ul>
 <li>
 Strong written, verbal and presentation skills.
 </li>
 <li>
 A willingness to work as part of a diverse team.
 </li>
 <li>
 A commitment to continuous improvement and lifelong learning.
 </li>
 <li>
 A passion for technology and a drive to deliver secure, high-quality solutions.
 </li>
 <li>
 Strong analytical and problem-solving skills.
 </li>
 <li>
 Excellent communication and interpersonal abilities.
 </li>
 <li>
 Ability to work effectively in a fast-paced and dynamic environment.
 </li>
 <li>
 Proactive and self-motivated with a keen attention to detail.
 
 
 </li>
 </ul>
 
 Connect to your service line &ndash; Technology and Transformation
 
 
 
 Distinctive thinking, deep expertise, and collaborative working. That&rsquo;s what connects us. That&rsquo;s what makes us Deloitte. If you want to help solve some of the biggest challenges around, join us. Together, we&rsquo;ll make an impact that matters.
 
 
 
 Personal independence
 
 
 
 Regulation and controls are standard practice in our industry and Deloitte is no exception. These controls provide important legal protection for both you and the firm. We are subject to several audit regulations, one of which requires that certain colleagues abide by specific personal independence constraints. This can mean that you and your "Immediate Family Members" are not permitted to hold certain financial interests (shares, funds, bonds etc.) with audit clients of the firm. The recruitment team will provide further detail as you progress through the recruitment process.
 
 
 
 Connect to your Industry
 
 
 
 &ldquo;What attracted me to Deloitte were the endless opportunities and the collective experience of other like-minded individuals. Deloitte&rsquo;s clients include many of the world&rsquo;s largest organizations; I wanted to be part of a team that made a difference that I could be proud of.&rdquo; Dan, T&amp;T.
 
 
 
 Connect with your colleagues
 
 
 
 Location: Cairo. Egypt
 
 
 Your Work, Your Way: We call our hybrid working vision Deloitte Works. And it does. We trust you to make the right choices around where, when, and how you work. You&rsquo;ll be able to make decisions about how you work best, to be collaborative, learn from colleagues, share your experiences, build the relationships that will fuel your career and prioritize your wellbeing. Having great conversations with your team and your leadership paves the way for great collaborative ways of working.
 
 
 
 Our commitment to you
 
 
 
 Making an impact is more than just what we do: it&rsquo;s why we&rsquo;re here. So we work hard to create an environment where you can experience a purpose you believe in, the freedom to be you, and the capacity to go further than ever before.
 
 
 We want you. The true you. Your own strengths, perspective, and personality. So, we&rsquo;re nurturing a culture where everyone belongs, feels supported and heard, and is empowered to make a valuable, personal contribution. You can be sure we&rsquo;ll take your wellbeing seriously, too. Because it&rsquo;s only when you&rsquo;re comfortable and at your best that you can make the kind of impact you, and we, live for.
 
 
 Your expertise is our capability, so we&rsquo;ll make sure it never stops growing. Whether it&rsquo;s from the complex work you do, or the people you collaborate with, you&rsquo;ll learn every day. Through world-class development, you&rsquo;ll gain invaluable technical and personal skills. Whatever your level, you&rsquo;ll learn how to lead.
 
 
 
 Connect to your next step
 
 
 
 A career at Deloitte is an opportunity to develop in any direction you choose. Join us and you&rsquo;ll experience a purpose you can believe in and an impact you can see. You&rsquo;ll be free to bring your true self to work every day. And you&rsquo;ll never stop growing, whatever your level.
</div>

Deloitte Innovation Hub I Cyber Security I Digital Forensics Incident Response Senior Engineer, Cairo, Egypt.

DoorDash

<div><h2 class="jobSectionHeader">About the Team</h2>

The Global Safety and Security team advances DoorDash through the protection of people, property, operations, brand, and reputation. We manage safety and security risk and provide value across the business through technology, and a people-first approach. Our team strives to always be in front and there for our people anytime, anywhere.
<h2 class="jobSectionHeader">
About the Role</h2>

The Physical Security Agent, Critical Incident Response Team (CIRT) is responsible for real-time monitoring, triage, and response to incidents that impact DoorDash's global workforce, assets, and operations. You'll serve as a front-line responder, analyzing alerts, coordinating response actions, and escalating issues according to established Global Safety &amp; Security (GSS) protocols.

This role sits at the heart of DoorDash's emergency response network &mdash; ensuring rapid, informed, and coordinated action during critical events such as natural disasters, workplace emergencies, or significant disruptions. Working closely with regional and global partners, you'll help keep DoorDash's people safe and operations running smoothly around the clock.
<h2 class="jobSectionHeader">
You're excited about this opportunity because you will&hellip;</h2>
<h4 class="jobSectionHeader">Security Operations &amp; Monitoring</h4>
<ul><li>Monitor and assess alerts from global intelligence, safety, and security systems to identify potential threats or incidents</li>
<li>Patrol and assess potential behavioral escalations or concerns</li>
<li>Conduct routine lobby and facility patrols to ensure safety, security, and compliance</li>
<li>Perform door, camera, and access point checks</li>
</ul><h4 class="jobSectionHeader">Access Control &amp; Visitor Management</h4>
<ul><li>Manage employee and guest badging, including badge printing, activation, and access level assignments (experience with Genetec, Lenel S2, or similar systems)</li>
</ul><h4 class="jobSectionHeader">Incident Response &amp; Safety</h4>
<ul><li>Triage incidents, determining severity and escalation requirements in accordance with CIRT standard operating procedures</li>
<li>Act as the initial point of contact for incident reporting, ensuring information is captured accurately and escalated efficiently</li>
<li>De-escalate situations involving employees, vendors, and guests as needed</li>
<li>Support activation and execution of emergency response and crisis communication protocols</li>
</ul><h4 class="jobSectionHeader">Employee Engagement</h4>
<ul><li>Coordinate with internal teams (e.g., Workplace, HR, Legal, Comms, Operations) and external partners (e.g., law enforcement, emergency services) during incident response</li>
<li>Disseminate timely situational updates and intelligence to relevant stakeholders</li>
</ul><h4 class="jobSectionHeader">Asset &amp; Inventory Management</h4>
<ul><li>Maintain inventory, readiness, and restocking of first aid kits, AEDs, and other emergency response materials in coordination with Workplace teams</li>
<li>Ensure emergency supplies are documented, tracked, and available to support incident response operations</li>
</ul><h4 class="jobSectionHeader">Documentation, Compliance &amp; Technology</h4>
<ul><li>Maintain SOPs, post orders, incident reports, and audit records</li>
<li>Ensure adherence to corporate safety, security, and compliance standards</li>
<li>Maintain detailed logs, case notes, and documentation using Jira and other internal tools</li>
<li>Participate in after-action reviews to improve process and operational efficiency</li>
</ul><h4 class="jobSectionHeader">Events Support</h4>
<ul><li>Support local events, executive visits, and executive protection details from an incident monitoring, coordination, and escalation perspective</li>
<li>Coordinate with Workplace, Security, and event stakeholders to ensure appropriate safety coverage and response readiness</li>
<li>Monitor events for emerging risks, incidents, or escalations and facilitate timely response as needed</li>
</ul><h4 class="jobSectionHeader">Additional Duties</h4>
<ul><li>Support after-hours, weekend, and holiday response as required by business needs</li>
<li>Support special projects or operational needs as assigned</li>
<li>Assist with credentialing, crowd flow, and safety monitoring during higher-volume office days or events</li>
<li>Travel up to 5% as required for training or business support</li>
</ul><h4 class="jobSectionHeader">Schedule &amp; Work Environment</h4>
<ul><li>On-site role, 40 hours per week</li>
<li>Schedule may vary based on operational needs</li>
<li>After-hours, weekends, and holidays as required by business needs</li>
</ul><h2 class="jobSectionHeader">We're excited about you because&hellip;</h2>
<ul><li>2&ndash;4+ years of experience in emergency management, public safety, dispatch, GSOC, or related security operations environment</li>
<li>CPR, First Aid, AED certification (current)</li>
<li>Advanced First Aid training (EMT preferred)</li>
<li>Strong analytical and situational awareness skills &mdash; able to prioritize under pressure</li>
<li>Exceptional written and verbal communication, particularly in high-stakes or time-sensitive situations</li>
<li>Familiarity with incident management systems and communication tools (e.g., Everbridge, Dataminr, OnSolve, or similar)</li>
<li>Calm and composed in emergencies, with strong problem-solving and judgment skills</li>
<li>Willingness to work non-standard hours, including nights, weekends, and holidays</li>
<li>Fluency in English required; additional language skills (Spanish, French, or Mandarin) a plus</li>
<li>Bachelor's degree or equivalent work experience in a relevant field (e.g., emergency management, criminal justice, homeland security)</li>
<li>Great communication and relationship building skills</li>
</ul><h3 class="jobSectionHeader">You'll Love This Role If</h3>
<ul><li>You thrive in high-tempo, real-time environments where every second matters</li>
<li>You find purpose in helping protect people and operations from emerging risks</li>
<li>You enjoy staying calm under pressure and making smart, quick decisions</li>
<li>You value teamwork, precision, and continuous improvement</li></ul> 


Notice to Applicants for Jobs Located in NYC or Remote Jobs Associated With Office in NYC Only

We use Covey as part of our hiring and/or promotional process for jobs in NYC and certain features may qualify it as an AEDT in NYC. As part of the hiring and/or promotion process, we provide Covey with job requirements and candidate submitted applications. We began using Covey Scout for Inbound from August 21, 2023, through December 21, 2023, and resumed using Covey Scout for Inbound again on June 29, 2024.

The Covey tool has been reviewed by an independent auditor. Results of the audit may be viewed here: Covey<div><h2 class="jobSectionHeader">
About DoorDash</h2>

At DoorDash, our mission to empower local economies shapes how our team members move quickly, learn, and reiterate in order to make impactful decisions that display empathy for our range of users&mdash;from Dashers to merchant partners to consumers. We are a technology and logistics company that started by enabling door-to-door delivery, and we are looking for team members who can help us go from a company that is known as the place you order food to a company that people turn to for any and all goods. 
 
DoorDash is growing rapidly and changing constantly, which gives our team members the opportunity to share their unique perspectives, solve new challenges, and own their careers. We're committed to supporting employees' happiness, healthiness, and overall well-being by providing comprehensive benefits and perks including premium healthcare, wellness expense reimbursement, paid parental leave and more.
<h2 class="jobSectionHeader">
Our Commitment to Diversity and Inclusion</h2>

We're committed to growing and empowering a more inclusive community within our company, industry, and cities. That's why we hire and cultivate diverse teams of people from all backgrounds, experiences, and perspectives. We believe that true innovation happens when everyone has room at the table and the tools, resources, and opportunity to excel.

Statement of Non-Discrimination: In keeping with our beliefs and goals, no employee or applicant will face discrimination or harassment based on: race, color, ancestry, national origin, religion, age, gender, marital/domestic partner status, sexual orientation, gender identity or expression, disability status, or veteran status. Above and beyond discrimination and harassment based on &quot;protected categories,&quot; we also strive to prevent other subtler forms of inappropriate behavior (i.e., stereotyping) from ever gaining a foothold in our office. Whether blatant or hidden, barriers to success have no place at DoorDash. We value a diverse workforce &ndash; people who identify as women, non-binary or gender non-conforming, LGBTQIA+, American Indian or Native Alaskan, Black or African American, Hispanic or Latinx, Native Hawaiian or Other Pacific Islander, differently-abled, caretakers and parents, and veterans are strongly encouraged to apply. Thank you to the Level Playing Field Institute for this statement of non-discrimination.

Pursuant to the San Francisco Fair Chance Ordinance, Los Angeles Fair Chance Initiative for Hiring Ordinance, and any other state or local hiring regulations, we will consider for employment any qualified applicant, including those with arrest and conviction records, in a manner consistent with the applicable regulation.

If you need any accommodations, please inform your recruiting contact upon initial connection.</div></div>

Agent, Critical Incident Response Team - New York, NY

Cartafella Analytics

We are looking for SOC Senior Analyst for Qatar location.<ul><li>Exposure to IT service management best practices such as ITIL and ISO27001</li><li>12+ years in SOC/IR/Digital Forencis preferable in MSSP.</li><li>Experience in ISO27001 process and procedures and can work on their own with little supervision</li><li>A good communicator at all levels.</li><li>A sound knowledge of IT security best practices, common attack types and detection / prevention methods.</li><li>Strong written and verbal communication skills</li><li>Attention to detail and great organisational skills</li><li>An active interest in Cyber Security, incident detection, network and systems security.</li><li>Experience or qualifications in network and systems monitoring</li><li>Experience in successful implementation / exposure / participation of a Business Continuity and Disaster Recovery Program</li><li>Experience in performing risk assessments and managing information security risks of an organization</li><li>University degree in any field related to Information Technology</li><li>Minimum 6+ years&rsquo; experience focused in the IT Security field (e.g. Incident Response, Incident Investigation, Incident Remediation)</li><li>Practical experience using SIEM platforms, preferably Google SecOps / Google Chronicle, including:</li><li>Maintain organization&rsquo;s compliance to various security standards such as ISO 27001/02, National Information Assurance Policy - Qatar</li></ul>Certification<ul><li>Certified Ethical Hacker</li><li>Certified Incident Responder Credentials from GIAC/SANS</li><li>Security+</li><li>CCSP / CCSE</li><li>Google SecOps</li></ul>If you are available, please send your cv immediatelyPay: Up to QAR2,000.00 per monthWork Location: In person

SOC Senior Analyst for Qatar

Arvest Bank

<div>Pay is based on a number of factors including the successful candidate&rsquo;s job-related knowledge and skills, qualifications, and prior experience. Arvest offers a comprehensive suite of benefits, including a full range of health and life, financial, and wellness benefits. For more information about benefits, please visit www.arvest.com/careers/benefits . 
 
Position is based at 201 W Walnut Street, Rogers, AR 72756.
Position requires flexible availability Monday through Friday 8am to 5pm with additional hours as needed.
The story of Arvest is one of commitment started by our founders in 1961, with an intense dedication to focusing on our customers. We will always be active and involved members of the communities we serve, and we will always work to put the needs of our customers and associates first as we continue to fulfill our mission &ndash; People helping people find financial solutions for life.
Job Title: Associate Security Operations Center Analyst
The Associate Security Operations Center (SOC) Analyst is an initial responder performing analysis, triage, and response coordination to security incidents and alerts ensuring the protection of critical systems and assets. They provide frontline support across various security tools and processes to prevent and respond to potential cyber threats.
What You&rsquo;ll Do at Arvest:
<ul><li>Support the team by gathering preliminary evidence, performing initial triage and basic threat analysis of incoming security alerts.
</li></ul><ul><li>Assist with initial response activities during security events and incidents, including cyber threats, major incident responses, physical security, and operational team notifications during outages.
</li></ul><ul><li>Help the team by performing critical event management functions, encompassing proactive severe weather communications, cybersecurity and physical security threat reporting, and the arrangement and implementation of relevant response protocols.
</li></ul><ul><li>Aid with threat intelligence analysis, frontline security incident, and initial incident reporting by collecting, reviewing, and analyzing data.
</li></ul><ul><li>Document and complete security incident and event reports while communicating findings to key stakeholders, contributes to the development of incident handling processes and security posture reports and maintain records of all security events, responses, and outcomes.
</li></ul><ul><li>Collaborate in the development and updates made to incident handling processes, standard operating procedures, playbooks, and runbooks.
</li></ul><ul><li>Identify opportunities for system and procedural improvements and recognize security gaps in critical infrastructure by adjusting alert thresholds, updating rules and security tool parameters.
</li></ul><ul><li>Understand and comply with bank policy, laws, regulations, and the bank's BSA/AML Program, as applicable to your job duties. This includes but is not limited to; complete compliance training and adhere to internal procedures and controls; report any known violations of compliance policy, laws, or regulations and report any suspicious customer and/or account activity.
</li></ul><ul><li>Other duties may be assigned. 
</li></ul> 
Responsibilities: 
 
Required Toolbox for Success:
<ul><li>High School Diploma or General Education Diploma (GED)
</li></ul><ul><li>1 year of relevant experience in Information Technology (IT), or Emergency Management including experience with security tooling
</li></ul><ul><li>Knowledge of security tools responding to security alerts using case management tool or IT ticketing system
</li></ul><ul><li>Analytical and conceptual thinking skills, with the ability to solve problems and make decisions using data
</li></ul><ul><li>Excellent communication and interpersonal skills, with the ability to build and maintain relationships with internal and external stakeholders
</li></ul><ul><li>Outstanding organizational skills and attention to detail, with the ability to manage multiple tasks and deadlines effectively
</li></ul><ul><li>Proven ability to analyze procedures and standards
</li></ul><ul><li>Ability to maintain an inquisitive mindset and desire for continuous learning
</li></ul><ul><li>Relevant military experience is considered for veterans and transitioning service members
</li></ul>Preferred Toolbox for Success:
<ul><li>Bachelor's Degree in Computer Science, Information Security, Information Technology, Emergency Management, or a related field
</li></ul><ul><li>Experience working in a regulated industry
</li></ul><ul><li>General knowledge in networking, monitoring, and incident response
</li></ul><ul><li>Knowledge of scripting or automation languages
</li></ul><ul><li>Working knowledge of Google Workspace and other applicable software
</li></ul>Physical Demands:
Regular attendance is an essential function of the job. The associate must be able to travel occasionally by themselves within the US, possibly overnight. Reasonable accommodations may be made to enable qualified individuals with disabilities to perform the essential functions.
We offer competitive compensation, benefits packages, and significant professional growth.
Arvest Bank is committed to providing equal opportunity to all persons regardless of race, color, race-based hairstyles and textures, religion, marital status, sex, sexual orientation, gender identity, pregnancy, age, national origin, disability, veteran status, or any other basis, which now or in the future may be specified by law.
Along with an excellent benefits package, our associates are engaged, rewarded for performance, and encouraged to grow professionally and personally. Our future is driven by our associates. If you want to be recognized for your results and empowered to reach your potential, we urge you to apply. 
 
Grade 14
Pay Range: $25.30 - $31.60 per hour</div>

Associate Security Operations Center Analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader">Cyber Threat Intelligence Analyst Job Description</h1>
Position: Cyber Threat Intelligence Analyst 
Program: SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader">
Position Summary</h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services. 
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader">
Essential Duties and Responsibilities</h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader">
Minimum Qualifications</h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader">
Preferred Certifications</h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul>
Pw75tUj9Bf</div>

SBA - Cyber Threat Intelligence Analyst

NMC Health plc

<div>Actively monitor the networks, systems, applications, IT assets and bio-medical equipment&rsquo;s for suspicious activity and threats. Using offensive and defensive measures and information collected from a variety of sources to identify, analyze, and report events that occur or may occur within the network and make the initial decision on the event/ threat severity.</div>
 <div><ul><li>Manage network, intrusion detection and prevention systems.
</li><li>Conduct periodic compromise assessments across selected networks and propose recommendations based on assessment results.
</li><li>Conduct physical security assessment of the organization&rsquo;s systems, including servers and networks, ensuring that any unauthorized external physical interference is not actually possible.
</li><li>Conduct ongoing network hunt activities.
</li><li>Conduct proactive vulnerability assessment across the network, subnetworks and service traffic to identify potential points of intrusion.
</li><li>Research and develop methods of tracking and detecting malicious activity within a network.
</li><li>Develop tools, signatures, and methods of detection for use in incident response activities.
</li><li>Develop SIEM integrations, dashboards, and analytics to illuminate and visualize threat activity.
</li><li>Analyze network traffic to provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities.
</li><li>Uses data collected from a variety of cyber defense tools (e.g., anti-virus, IDS alerts, firewalls, network traffic logs) to analyze events that occur within their environments, perform cyber defense trend analysis and reporting, and perform event correlation to mitigate threats and gain situational awareness and determine the effectiveness of an observed attack.
</li><li>Carries out triage to ensure that a genuine security incident is occurring.
</li><li>Coordinate with entity-wide cyber defense staff to validate network alerts.
</li><li>Notify designated managers, cyber incident responders, and cybersecurity service provider team members of suspected cyber incidents and articulate the event&rsquo;s history, status, and potential impact for further action in accordance with the organization&rsquo;s cyber incident response plan.
</li><li>Document and escalate incidents (including event&rsquo;s history, status, and potential impact for further action) that may cause ongoing and immediate impact to the environment.
</li><li>Provide daily summary reports of network events and activity relevant to cyber defense practices.
</li><li>Analyze identified malicious activity to determine weaknesses exploited, exploitation methods, effects on system and information.
</li><li>Validate intrusion detection system (IDS) alerts against network traffic using packet analysis tools.
</li><li>Isolate and remove malware.
</li><li>Develop content for cyber defense tools use them for continual monitoring and analysis of network activity to identify malicious activity.
</li><li>Assist in the construction of signatures which can be implemented on cyber defense tools in response to new or observed threats within the network environment.
</li><li>Analyze and report organizational security posture trends.
</li><li>Monitor external data sources (e.g., cyber defense vendor sites, Computer Emergency Response Teams, Security Focus, Threat Intelligence Providers) to maintain updated of cyber defense threat condition and determine which security issues may have an impact on the enterprise.
</li><li>Provides cybersecurity recommendations based on significant threats and vulnerabilities.
</li><li>Provide advice and input for Disaster Recovery, Contingency, and Continuity of Operational Plans.
</li><li>Collect and analyze intrusion artifacts (e.g., source code, malware, and system configuration) and use discovered data to enable mitigation of potential cyber incidents within the enterprise.
</li><li>Use specialized equipment and techniques to catalog, document, extract, collect, package, and preserve digital evidence.
</li></ul>Utilize deployable forensics toolkit to support operations as necessary</div>
 <div>Knowledge
<ul><li>Security concepts such as cyber-attacks and techniques, threat vectors, risk and threat management, incident management etc.
</li><li>Networking concepts and protocols, and network security attacks, vulnerabilities, processes, methodologies, access control mechanisms, traffic analysis methods.
</li><li>Cyber threats and vulnerabilities and information dissemination sources (e.g., alerts and advisories).
</li><li>Cyber defense and vulnerability assessment tools and their capabilities.
</li><li>System and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, Procedural Language/Structured Query Language [PL/SQL] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
</li><li>Scripting languages (e.g., Python, Perl, Bash) used in an incident response environment
</li><li>Incident response and handling methodologies.
</li><li>Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools, applications, methodologies and techniques for detecting host and network-based intrusions.
</li><li>Threat investigations, reporting and investigative tools.
</li><li>Cyber defense and information security policies, procedures, and regulations.
</li><li>Common attack vectors, the different classes of attacks (e.g., passive, active, insider, close-in, distribution attacks) and attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks).
</li><li>Cyber attackers (e.g., script kiddies, insider threat, non-nation state sponsored, and nation sponsored), and attackers&rsquo; methodologies.
</li><li>Signature implementation impact for viruses, malware, and attacks.
</li><li>Windows/Unix ports and services.
</li><li>Relevant laws, legal authorities, restrictions, and regulations pertaining to cyber defense activities.
</li><li>Packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
</li><li>Use of sub-netting tools.
</li><li>Penetration testing principles, tools, and techniques.
</li><li>Investigation, auditing and forensics methods, processes, procedures and standards.
</li><li>Different types of hardware, storage, imaging and file system analysis.
</li><li>Data backup and recovery.
</li></ul>Skills
<ul><li>Using SIEM/SOAR and Vulnerability Management tools and services.
</li><li>Sysadmin skills (Linux/Mac/Windows).
</li><li>Programming skills (Python, Ruby, PHP, C, C#, Java, Perl, and more).
</li><li>Identifying, analyzing and interpreting trends or patterns in complex data sets.
</li><li>Developing and deploying signatures.
</li><li>Detecting host and network-based intrusions via intrusion detection technologies (e.g., Snort).
</li><li>Using incident handling methodologies.
</li><li>Collecting data from a variety of cyber defense resources.
</li><li>Recognizing and categorizing types of vulnerabilities and associated attacks.
</li><li>Performing packet-level analysis.
</li><li>Conducting trend analysis.
</li><li>Using cyber defense reporting structure and processes.
</li><li>Utilizing a combination of automated and manual testing methods.
</li><li>Developing automated vulnerability testing scripts and using off the shelf vulnerability testing tools.
</li><li>Conducting vulnerability scans and recognizing vulnerabilities in networks, systems and applications.
</li><li>Using of penetration testing tools and techniques.
</li><li>Applying analytical and problem-solving skills.
</li></ul>Ability
<ul><li>Collaborate with other sections across the department to enhance detection capabilities.
</li><li>Perform Malware analysis.
</li><li>Work closely with management to respond appropriately to the results of assessments and mitigation oversight of found vulnerabilities.
</li><li>Perform data analysis, correlation, and analytics leveraging Security Information and Event Management (SIEM) tools.
</li><li>Conduct vulnerability scans and recognize vulnerabilities in security systems &amp; devices.
</li><li>Accurately and completely source all data used in intelligence, assessment and/or planning products.
</li><li>Apply techniques for detecting host and network-based intrusions using intrusion detection technologies.
</li><li>Interpret the information collected by network tools (e.g. Nslookup, Ping, and Traceroute).
</li><li>Prepare and create regular reports to document any security breaches/ incidents.
</li><li>Provide forensic support to Cyber Security Operations during the investigation of any detected threat or contained incident / event to determine root cause and propose response recommendations as required.
</li></ul>Education and Certification
<ul><li>Bachelor&rsquo;s degree in an information technology, computer science, cyber security or equivalent work experience.
</li><li>CompTIA Security+
</li><li>CISSP: Certified Information Systems Security Professional
</li><li>GCFA: GIAC Certified Forensic Analyst
</li><li>GCIH: GIAC Certified Incident Handler
</li><li>GCIA: GIAC Certified Intrusion Analyst
</li><li>OSCP: Offensive Security Certified Professional
</li><li>CEH: Certified Ethical Hacker
</li><li>CPT: Certified Penetration Tester
</li></ul>Experience
<ul><li>3 years of experience in cyber security operations with expertise in managing the Security Operations Center
</li><li>UAE experience preferred.</li></ul></div>

Information Security Specialist

Asyad Group

Asyad oversees Oman&rsquo;s logistics ecosystem including ports, shipping, and freight services.As a Cyber Security at Asyad Group - this role focuses on detecting, investigating, and responding to cyber threats to protect an organization&rsquo;s systems, data, and critical infrastructure.Job Description:1. Incident Detection &amp; ResponseMonitor security alerts using SIEM toolsInvestigate suspicious activities and cyberattacksPerform incident triage, analysis, and containment2. Threat Hunting &amp; MonitoringProactively search for hidden threats in systemsAnalyze logs (firewalls, endpoints, network traffic)Use tools like:EDR/XDR (e.g., CrowdStrike, SentinelOne)3. Digital Forensics &amp; InvestigationConduct malware analysis and forensic investigationsIdentify root cause of incidentsAssess scope and impact of breaches4. Containment &amp; RecoveryIsolate affected systemsRemove threats and restore operationsDevelop remediation plans5. Documentation &amp; ReportingCreate incident reports and post-mortem analysisRecommend security improvementsMaintain incident logs and compliance records6. CollaborationWork with:SOC (Security Operations Center) teamsIT and network teamsExternal cybersecurity vendors7. Security ImprovementImprove incident response processesDevelop playbooks and automationStay updated on emerging cyber threatsRequirements:Bachelor&rsquo;s degree in IT, Cybersecurity, or related fieldCertifications (preferred):CISSPCEHCompTIA CySA+ / Security+Experience:2&ndash;5 years (junior-mid)5+ years (senior roles)Job Type: Full-timePay: From RO1,500.000 per monthWork Location: In person

Cybersecurity / Incident Response Specialist (Asyad Group)

Search 1871+ Cyber incident responder jobs near you this May. New roles added regularly across leading industries. Apply today.