SECURITY ARCHITECT L1

Principal Accountabilities and Responsibilities (e.g., for Business, Customers and Stakeholders; internal control environment, etc.) | What you’ll do: (List out Key Responsibilities) *

· Work as a senior member of the Monitoring and Threat Detection team within an “Analysis POD” tasked with triage of threat detection events from across the entire global HSBC technology estate.

· Collaborate with colleagues across Threat Detection and Incident Management areas to ensure a rapid and focussed identification and escalation of potential threat events.

· Provide support into Incident Response actions, providing SME knowledge to ensure continuity and depth of investigation.

· Involvement in “Purple Team” and Threat Simulation activities, ensuring that the detection capability is accurately assessed and validated.

· Collaborate with the Threat Hunters on hypothesis driven threat hunt and advanced data analysis.

· Apply structured analytical techniques and critical thinking to ensure consistent triage of threat events.

· Contribute to post-incident reviews, ensuring that output is captured and use to continually improve detection posture.

· Provide quality assurance and oversight to investigation tickets, ensuring that ideas for improvement and training are captured in an objective manner.

· Provide expert-level advice and technical leadership to the team, driving the continued evolution of hunting, monitoring, detection, analysis and response capabilities and processes.

· Train, develop, mentor, and inspire cybersecurity colleagues in area(s) of specialism.

· Review technical threat intelligence reports and apply detailed analysis of Indicators of Attack to ensure that we are able to defend against similar threats.

· Identifying new SIEM detection use cases, taking end-to-end ownership of the delivery including testing, triage documentation and training requirements.

· Identify processes that can be automated and orchestrated to ensure maximum efficiency of Global Cybersecurity Operations resources, reducing manual repetitive tasks where possible.

Functional Knowledge

· Excellent investigative skills, insatiable curiosity, and an innate drive to win.

· Good understanding and knowledge of common industry cyber security frameworks, standards and methodologies, including MITRE ATT&CK, OWASP, ISO2700x series, PCI DSS, GLBA, EU data security and privacy acts, FFIEC guidelines, CIS and NIST standards.

· Expert level knowledge and demonstrated experience in analysis and dissection of advanced attacker tactics, techniques, and procedures to inform adjustments to the control plane.

· Expert level of knowledge and demonstrated experience of common Security Information and Event Management (SIEM) platforms for the collection and real-time analysis of security information.

· Expert level knowledge of Enterprise Detect and Response (EDR) tooling for the identification, prevention, and detection of cyber-threats and for use in triage, investigation, and threat hunting.

· Detailed knowledge and demonstrated experience of common cybersecurity technologies such as IDS / IPS / HIPS, Advanced Anti-malware prevention and analysis, Firewalls, Proxies, MSS, etc.

· Excellent knowledge and demonstrated experience of common operating systems and end user platforms to include Windows, Linux, Citrix, ESX, OSX, etc.

· Excellent knowledge of common network protocols such as TCP, UDP, DNS, DHCP, IPSEC, HTTP, etc. and network protocol analysis suits.

· Good knowledge and demonstrated experience in incident response tools, techniques and process for effective threat containment, mitigation, and remediation.

· Functional knowledge of Security Orchestration Automation and Response (SOAR) platforms including development and implementation of automation routines.

· Functional knowledge and technical experience of cloud computing platforms such as AWS, Azure, and Google.

Others

· Basic knowledge and demonstrated experience in common cybersecurity incident response and forensic investigation tools such as: EnCase, FTK, Sleuth kit, Kali Linux, IDA Pro, etc.

· Functional knowledge of scripting, programming and/or development of bespoke tooling or solutions to solve unique problems.