Business Function

Group Technology and Operations (T&O) enables and empowers the bank with an efficient, nimble and resilient infrastructure through a strategic focus on productivity, quality & control, technology, people capability and innovation. In Group T&O, we manage majority of the Bank's operational processes and inspire to delight our business partners through our multiple banking delivery channels. The Cyber Security Threat Hunting Analyst is to protect the environment and the interest of the Bank against advanced threat actors in order to ensure business continuity with minimal to no impact.

The threat hunting role is to sniff out highly advanced cyber threats that cannot be mitigated by traditional layered security controls. The job is to track and neutralize adversaries who cannot be caught such means. The threats to hunt for can be posed by either an insider, such as an employee of the organization, or an outsider, such as an organized crime group and is usually higher sophisticated and complex. The threat hunter carefully analyzes the whole environment, uses behavioral analysis and a hypothesis-driven approach to find unusual behavior that may indicate the presence of malicious activity. His objective is to ensure that the environment is protected and mitigated against such attacks via early detection mechanism and reducing the Mean-Time-To-Respond (MTTR).

Responsibilities

• Keep abreast in the development and advancement in Cyber Security technology and the Threat Intelligence landscape.
• In-depth knowledge of the Cyber Kill Chain with experience in incident response from a Kill Chain perspective.
• Comprehensive mastery of the MITRE ATT&CK framework and leverage on ATT&CK framework to build layered defence.
• Actively develop hunts, translate them into an iterative process, and deploy them in numerous EDR solutions.
• React to EDR based alerts and perform forensic investigation.
• Understand the critical assets in their environment to develop advanced detections and reporting.
• Develop and mature new and existing solutions for threat hunting detection capabilities.
• Fully document and communicate findings to an array of audiences which includes both technical and executive teams.
• Make recommendations regarding the selection of cost-effective security controls to mitigate risk (e.g., protection of information, systems and processes).
• Familiar with DevSecOps and practises the methodology in work.
• Work closely with the SOC and CERT teams during incident response to contain and mitigate attacks.
• Possess expertise from offensive security to provide insights and advisory in strategic defensive planning.

Requirements

• Apply programming languages and scripting to new or existing processes.
• Pivot off indicators within networks to identify the scope and breadth of attacks.
• Developing threat hunts based on various inputs.
• Actively developing hypotheses for hunting.
• Performing both host and network-based investigations.
• Reviewing logs to identify evidence of past intrusions.
• 3+ years working in security operations.
• Experience in the Banking industry will be an advantage.
• Familiar with security products and network devices especially endpoint detect and respond tools.
• Extensive technical experience with network security practices including Intranet, Extranet and Internet access.
• Technical experience with Database, UNIX, Windows.
• Programing/Scripting experience with Python, Perl, Java, Powershell, and/or SQL.
• Knowledge of TCP/IP, DNS, web, wireless security architectures and technologies.
• Knowledge of encryption and authentication methods such as 2FA, DES, Digital Certificates, SSL, IPSec and development of DMZ's.
• Knowledge of intrusion detection (deep TCP/IP knowledge, and cybersecurity), various operating systems (Windows/UNIX), and web technologies (especially internet security).
• Able to read and understand packet level data, handle Network/Host Security products (NIDS/NIPS, firewalls, HIPS, AV, scanners, etc.) and understand security events from these tools.
• Certifications from EC-Council, CSX, GIAC, (ISC)², SANS and CREST are preferred [CISSP, C|EH, GCIA, CCNA].
• Be performance oriented; always try to excel past achievements
• Able to work under pressure during critical situations
• Able to work in a collaborative manner with peers
• Can communicate effectively with peers in discussions/meetings

Apply Now

We offer a competitive salary and benefits package and the professional advantages of a dynamic environment that supports your development and recognises your achievements.