I52 - Security Analyst (120)

Description

The Security Analyst is responsible for administering, maintaining and continuously improving the security controls of Income Insurance Limited's (Income) enterprise security tools, including the Google Security Operations (SecOps) platform, Network Traffic Analysis (NTA) and Gigamon visibility tools, and Endpoint Detection and Response (EDR). The role ensures these platforms remain healthy, correctly configured and tuned to detect and contain current and emerging cyber threats across on-premises, cloud and hybrid environments. He/She will also lead security tool integration, technology refresh and improvement projects, working closely with IT infrastructure and application teams, business units, the managed SOC and product vendors to protect Income's confidential information.

This security systems administration and operations role sits within the IT Risk and Security Department and reports to the Security Operations Manager.

Key Responsibilities

• Security tool administration: Administer, configure and maintain Income's security tools, including Google SecOps, NTA and Gigamon tools, EDR, Intrusion Prevention System (IPS) and Database Activity Monitoring (DAM). This covers policy and rule configuration, agent and sensor deployment, log-source onboarding, user access management, upgrades, patching, and health and availability monitoring.
• Control improvement and tuning: Continuously review and improve tool configurations, detection rules, prevention policies and exclusions to reduce false positives, close detection gaps and align controls with the MITRE ATT&CK framework and current threat intelligence.
• Visibility and coverage: Ensure complete and reliable security telemetry for on-premises and cloud assets by onboarding new log sources, endpoints and network segments, validating data quality, parsing and retention, and tracking coverage gaps to closure.
• Threat detection and containment: Support the managed SOC and incident response team by using SIEM, EDR and NTA capabilities to investigate, isolate and contain threats, and implement control improvements arising from incidents, red team exercises, table-tops and post-incident reviews.
• Security control assessment: Analyse, assess and evaluate security controls for systems deployed on-premises and in the cloud, provide visibility into the security posture of these assets, and recommend improvements to strengthen Income's cyber defence.
• Automation and AI: Apply automation, SOAR and AI-driven capabilities to streamline repetitive administration and response tasks, consolidate and integrate security controls, and reduce management complexity and cost, with appropriate validation of outputs.
• Reporting and metrics: Use SIEM and analytics tools to produce insightful operational and management metrics on tool health, detection coverage, alert trends and control effectiveness for weekly, monthly and quarterly reporting.