Cyber Incident Response Specialist

• Technical degree or higher in computer science or telecommunications.
• Experience in managing SOC, CSIRT, or DFIR.
• Knowledge
• Experience in managing technological projects.
• Ability to work in cross-functional teams.
• Communication skills and relational abilities.
• Analytical and synthesis skills with a strategic vision.
• Adaptability to change.
• Availability to travel.
• Spoken and written English.

• Cyber-attack techniques and tactics
• Agile working methodologies.
• Security best practices and regulations/standards.
• Training and certifications related to cybersecurity.
• SIEM (Sentinel, Splunk, QRadar, etc.).
• EDR/XDR.
• Cloud (Azure, AWS, GCP).
• Forensic tools.
• SOAR.
• Threat Intelligence Tools.

The purpose of this call is to fill a vacancy for a manager in the Cybersecurity department, which could be indicators of the initial stages of cyber

Department mission__SJ_HTML

We are responsible for preventing and defending the Entity, our clients, and

The main areas of action are detection, response to cyber incidents, and

Security Analytics __SJ_HTML

Define and control security analytics processes for the purposes of prevention, detection, and response.

Detection

Definition of detection controls for attacks or anomalies that could indicate initial phases of cyberattacks, aligned with the MITRE Att&ck matrix.

CSIRT (Computer Security Incident Response Team)

Definition, control, and execution of playbooks in the face of cyber threats and cyberattacks. Recovery processes for cyberattacks are also defined for execution by IT teams.

Cybersecurity Operations (Cyber SOC)

Understanding of a CyberSOC and the operation of analysis and response playbooks for cybersecurity events, as well as the review of these to apply improvements.

Cyber Threat Intelligence __SJ_

Threat Intelligence process as input to prevention processes against cyberattacks, which identifies malicious actors with potential impact on the entity, measures the level of impact based on the tactics and techniques and vulnerabilities that they use, maintains a risk scoring per actor and generally a risk metric as an anticipatory measure of cyber-risk.

Candidate profile: they must have, in particular, the capacity to be part of cyber incident response processes; that is, the capacity for process definition, analysis, and incident response.

Establish, apply, and control security policies to predict, identify, and mitigate

• Definition and control of response processes for cyber incidents Must have knowledge of the MITRE attack and detection matrix, must have knowledge of cyberattack techniques
• Definition of technical response playbooks to cyber-incidents, adapting existing ones and creating new ones to cover new cyber-threats.
• Definition of solutions to cover response needs in different corporate technological environments
• Definition and control of the analysis and response processes of the cybersecurity operations team (Cyber SOC)
• Definition and control of the processes of the cybersecurity incident response center (CSIRT)
• Definition and control of cyberattack simulation environments to ensure the completeness and effectiveness of the implemented prevention and detection controls.
• Definition and control of post-incident recovery processes based on the defined cyber-incident response playbooks.
• Must have knowledge of the MITRE detection and attack matrix, must have knowledge of cyber-attack techniques and tactics, as well as forensic analysis knowledge.

The job position is located at CaixaBank's Head Offices in Madrid