Note: The job is a remote job and is open to candidates in USA. Viatris is a global healthcare company that provides access to high-quality medicines worldwide. The Senior Analyst, Incident Response role analyzes security data, investigates and contains cyber threats and malware, supports forensic investigations, and coordinates incident response activities across the enterprise. The role also develops threat intelligence, prepares incident briefings, and helps maintain security standards, policies, and procedures.
Responsibilities
- Perform analysis of log files from a variety of sources (e.g., individual host logs, network traffic logs, security system logs, and intrusion detection system [IDS] logs, Endpoint Detection and Response systems, and SIEM logs) to identify threats to security
- Utilize incident handling methodologies and frameworks (e.g. (VERIS, MITRE, NIST, ISF))
- Coordinate and provide expert technical support and guidance to enterprise-wide cyber security partners to resolve cyber incidents and implement best practices
- Coordinate with enterprise-wide cyber defense staff to review escalated incidents
- Assess the effectiveness of security controls for services, applications, and associated processes
- Identify, capture, contain, and report on malware
- Analyze and review anomalous code as malicious or benign
- Isolate, analyze, and remove malware
- Design countermeasures for known and intelligence driven identified security risks and threat actors
- Collect, process, package, transport, and store electronic evidence to avoid alteration, loss, physical damage, or destruction of data during security incidents
- Review logs to identify evidence of past intrusions
- Characterize and analyze logs, alerts, analytics, network traffic, reports, events, trends, threat tactics, business and event triggers, to identify anomalous activity and potential threats
- Confirm what is known about an intrusion and discover new information, if possible, after identifying intrusion via dynamic analysis
- Create a forensically sound duplicate of the evidence (i.e., forensic image) that ensures the original evidence is intentionally modified, to use for data recovery and analysis processes. This includes, but is not limited to, hard drives, floppy diskettes, CDs, PDAs, mobile phones, GPS, and all tape formats
- Provide technical and non-technical summary of incident findings in accordance with established incident response plan
- Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
- Monitor open-source websites and intelligence feeds for hostile content directed towards organizational or partner interests
- Identify cyber threat tactics and methodologies and integrate them into threat hunting and threat reports
- Prepare and present incident response briefings
- Assist with the development and documentation of data standards, policies, and procedures
- Ensure that managed security services, products, partners, or other compensating security control technologies reduce identified risk to an acceptable level
- Ability to function in a collaborative environment, seeking continuous consultation with other analysts and experts—both internal and external to the organization—to leverage analytical and technical expertise
Skills
- Bachelor's degree required; MIS, IT, or Engineering related
- Must possess knowledge in 1 or more of the following: security operations, incident response, threat hunting, threat intelligence
- Knowledge of scripting: PowerShell or Python
- Experience utilizing the following Microsoft tooling: Word, Excel, Visio, PowerPoint, Power Automate
- Exceptional teamwork and collaboration skills
- Strong written and verbal communication skills
- Proficiency in speaking, comprehending, reading, and writing English is required
Company Overview
Company H1B Sponsorship