Information Security Consultant

Information Security Consultant

This role is part of NCR Voyixs Global Information Security team. This team is responsible for supporting and progressing NCR Voyixs Corporate Information Security program. The primary goal of the program is to protect the confidentiality integrity and availability of information resources.

We are seeking a highly skilled and experienced Information Security Consultant will be responsible for day-to-day activities which include responding to both routine and high severity incidents and leading our Forensics E-Discovery team. This is a position where the ideal candidate will have a strong backgroundin network incident response digital forensics e-discovery processes and litigation support.

Key Responsibilities

• Collaborate with internal and customer teams to investigate and contain incidents. Conduct host forensics network forensics log analysis and malware triage in support of incident response investigations.
• Recognize and codify attacker Tools Tactics and Procedures (TTPs) and Indicators of Compromise (IOCs). Build scripts tools or methodologies to enhance Mandiants incident investigation processes that can be applied to current and future investigations.
• As an active member of the team monitor and process response for security events on a 24x7 basis.
• Analyze attack vectors and methods to develop custom Splunk ES SIEM signatures or detections
• Provide and implement recommendations to improve Splunk ES detections
• Lead the SOCs incident response team threat hunting and incident response activities
• Lead Postmortem exercises post incidents with a focus to identify deficiencies requiring additional attention.
• Analyze and respond to security threats from Firewall (FW) Intrusion Detection Systems (IDS) Intrusion Prevention Systems (IPS) Antivirus (AV) Endpoint Detection and Response (EDR) Network Detection and Response (NDR) Email Security Cloud Security and other security threat data sources.
• Oversee the collection preservation and analysis of electronic data and metadata in response to litigation regulatory inquiries and internal investigations.
• Collaborate and communicate with the Law Department and Global Security teams to understand case requirements and provide guidance on e-discovery and digital forensics matters.
• Conduct data collection from U.S.-based and in some cases internationally-based digital devices including computers mobile devices and cloud-based and network systems; deduplicate and import said data into Relativity or other e-discovery review platform.
• Develop and implement e-discovery strategies and workflows to ensure efficient and defensible processes.
• Leverage knowledge in multiple security disciplines such as Windows Unix Linux data loss prevention (DLP) endpoint controls Public Cloud and networking to offer global solutions for a complex heterogeneous environment.
• Provide or facilitate the forensics analysis of security events.
• Develop and implement e-discovery strategies and workflows to ensure efficient and defensible processes.
• Stay current with industry trends tools and best practices in digital forensics and e-discovery.
• Support 24/7 operations
• Work non-standard hours including nights weekends and holidays
• Perform other duties as assigned

Skills and Qualifications

• 5 Years as a Senior incident responder/leader of incident response
• 2 - 3 years of experience with Splunk and CrowdStrike
• Experience configuring custom Splunk searches and applications required
• Experience with analyzing attack vectors and methods in order to develop Splunk ES SIEM signatures or detections
• Experience with SOC Operations
• Experience with threat hunting
• Ability to apply analytical expertise and critical thinking to security incidents
• Ability to assimilate understand and utilize various security technologies
• Ability to collaborate within a geographically distributed team of Incident Response Analysts
• Demonstrated team or functional leadership experience
• Experience processing and analyzing intelligence in support of management decision making
• Current Information Security related certification preferred.
• Current Public cloud related certification preferred.
• Knowledge of relevant information security and incident response frameworks such as ISO 27001 NIST SP 800-61 NIST Cyber Security Framework MITRE ATT&CK Framework.

Licenses/Certifications

• CISSP Certified Information Systems Security Professional
• Certified Ethical Hacker (CEH)
• CompTIA Network Certification
• CompTIA Security Certification