A leading financial services organisation is looking for an experienced Security Analyst to strengthen its security capability. You'll be the person who spots targeted attacks against critical, customer-facing assets in the noise of logs and events, and helps shut them down.
You'll work in a high-performing security team, ideally using Splunk and your knowledge of current attack techniques to detect, investigate and respond to threats across web applications, networks and endpoints.
What you'll do
- Analyse web, application, authentication, endpoint and security appliance logs to identify malicious activity
- Use Splunk (or any other SIEM tool) to investigate security events, and build macros, alerts and dashboards that surface targeted attacks
- Identify common exploits and attack patterns (OWASP Top 10 and beyond) from web and event logs
- Interpret Apache, IIS and Active Directory logs alongside other security data sources
- Detect anomalous or malicious network activity using advanced analytics and security tooling
- Support incident response, recommending and helping implement mitigations, including WAF and CDN security controls
- Interpret stateful firewall rules and contribute to security operations procedures and continuous improvement
About you
Essential
- 3-6 years' experience in a similar role
- Strong intrusion analysis background, with proven ability to interpret web and application logs from a security perspective
- Solid understanding of how web applications work under the hood, including HTTP/HTTPS, DNS and TLS
- Knowledge of common web application attack vectors and current exploits, including SQL injection, cross-site scripting and remote file inclusion
- Experience independently investigating issues end-to-end and incident response experience
- Comfortable with scripting languages and regular expressions
- Working knowledge of enterprise client/server architecture
- Intermediate to expert capability, equivalent to L2/L3 in a tiered SOC model
- Experience with Web Application Firewalls (WAF)
- Experience with Akamai or other CDN security controls beneficial
#J-18808-Ljbffr
Security Detection and Response Analyst in Sydney employer: Morgan McKinley
Morgan McKinley is an excellent employer that fosters a collaborative work culture, encouraging innovation and professional growth for its employees. With a focus on performance and security in the ServiceNow platform, team members benefit from ongoing training opportunities and a supportive environment that values their contributions. Located in a vibrant area, the company offers unique advantages such as flexible working arrangements and a commitment to employee well-being.
