The Senior Security Analyst

We are seeking a Senior Security Analyst. This person will be a Security Analyst and Detection and Response expert. They will have experience supporting a Global team protecting networks from cyber threats. This position will require a large degree of autonomy. This position reports to the Head of IT Security Detection and Response in Denmark. Are you our new Senior Security Analyst SOC Engineer? Click the apply-button to send your application! Inviting bright minds Do you want to push the boundaries of your profession and develop your excellence in an open, collaborative and empowering culture? We work to create a sustainable future and our inspiring projects and innovative solutions strive to set the standard among our peers. You will join a global company that has been growing successfully since its founding in 1945. Together, we lead and leave a positive impact on societies, companies and people around the world. The Senior Security Analyst is responsible for enabling the Ramboll Detection & Response teams to protect our networks, systems, and data using a variety of Security Tools and automation platforms. This role will work assist the Detection and Response team in planning and building defensive, customized security playbooks and automations using our SOAR (Security Orchestration Automation and Response) platform. This role is highly detail oriented and requires hands-on knowledge of Microsoft Defender products, ServiceNow, Programming/Scripting Languages, Security Operations, and API integrations. This Senior Security Analyst professional role is responsible for planning, designing, and testing the deployment/implementation of complex security systems to fulfill our business needs. This includes design/update architecture overviews and transitioning these solutions to operations The Senior Security Analyst must be able to automate and improve the detection, investigation, and response processes as well as plan and execute roadmap strategies. Design, build and maintain efficient, reusable, and reliable Security Automations for the SOC teams, as well as other Cyber Security Operations teams Create detailed technical process documentation Review API documentation and connect third-party services to our SOAR platform Experience with Splunk and/or IBM QRadar are a plus Familiar with the concepts like: Endpoint Detection and Response (EDR), Threat & Vulnerability Management (TVM), Attack Surface Reduction (ASR), and Auto Investigation and Remediation (AIR) Hands-on experience with Microsoft Security Products is highly desirable Be aware of the cyber security risks and threats surrounding the workplace (secure devices, manage access, protect data, and mitigate threats) and have discussions on these topics with our clients Experience with Threat Modeling and executing risk assessments is a plus A willingness to become a subject matter expert on our security tooling and to guide and train members of our SOC team to use and maintain our security solutions Have a passion towards automation and a real desire to make the job easier for the Security Analysts Be able to maintain current knowledge of tools and best practices in combatting advanced persistent threats, including tools, techniques, and procedures (TTPs) of attackers and tools and processes for forensics and incident response Must be able to understand workflows, processes and appropriately develop automation techniques to streamline and enhance capabilities Implementing a MITRE ATT&CK first approach in the work we do – Threat Informed Defense Must be proficient in handling Cyber Security Incidents Your starting point for constant growth From the moment you join Ramboll, we will support your personal and professional development so that you grow with the company. For this role, we believe your starting point is: Strong experience in a security automation development environment Strong hands-on experience with scripting languages such as JavaScript and Python Strong experience in a segment of cyber security: i.e., SOC Analyst, SOC Engineer, Incident Responder, Incident Handler Familiarity with at least one query language like SQL, MySQL, SPL, Kusto, etc. Experience working with REST and other third-party API integrations Good understanding of security infrastructure and related technologies (proxies, firewalls, email filtering technologies, and network intrusion detection systems) Experience with Microsoft Defender for Endpoint solutions.
Additional experience with Microsoft Defender for O365, Microsoft Defender for Identity, Microsoft 365 Defender and Microsoft Cloud App Security is highly desired Experience with virtualized environments like VMWare or VirtualBox Experience with cloud security for Azure or other major cloud provider Experience with ServiceNow SOAR or similar SOAR security products – like Palo Alto Cortex, highly desired Consulting experience is a plus The successful candidate will have the following attributes: Excellent communication and presentation skills, with the ability to talk with a variety of internal and external audiences Ability to handle multiple projects with limited oversight Experience with scrum or other agile development methodologies Ability to build strong client relationships and to interact effectively at all levels of the Cyber Security Operations organization, including senior executive How to apply
Apply online. Attach your CV, cover letter and relevant documents showcasing why you are the right fit for the role, and when you are available to start. We look forward to receiving your application. For further information, please contact, Christian Klint,Senior Manager, Head of Cyber and Information Security Architectureat [email protected]. Deadline: 30.06.2023