SOC Incident Responder
4 weeks ago
Trust is part of our DNA at Citi. As such, we take safeguarding our customer data very seriously. The Chief Information Security Office (CISO) is made up of deeply dedicated and talented colleagues who work together to ensure the safety of Citi's and our clients' assets and information. We manage information security as an end-to-end program - one with a clear mandate and accountability. Our mission is to continually execute and enhance a global security program that is fully anchored to modern control and security frameworks, fully aligned with the technology of the firm, threat-focused and data-driven, and deeply integrated across all Citi businesses globally.
Being talent-driven, we are focused on attracting, developing, and retaining diverse and inclusive talent with a high technical skill level. As a member of our team we will provide you with career development opportunities at all stages of your career. Our employees model a passion for protecting Citi and our clients and believe in treating others with dignity and respect.
Our commitment to diversity includes a workforce that represents the clients we serve globally from all walks of life, backgrounds, and origins. We foster an environment where the best people want to work. We value and demand respect for others, promote individuals based on merit, and ensure opportunities for personal development are widely available to all. Ideal candidates are innovators with well-rounded backgrounds who bring their authentic selves to work and complement our culture of delivering results with pride. If you are a problem solver who seeks passion in your work, come join us. We'll enable growth and progress together
SOC Incident Responder (AVP)
Citi's Security Operations Center (SOC) Incident Response Team seeks a highly skilled and experienced incident response practitioner to support critical efforts aimed at protecting Citi infrastructure, assets, clients and stakeholders. This is a demanding role with global exposure and responsibility. You will serve both as a technical subject matter expert and as an ambassador for the incident response team. You will be assigned to Citi's SOC and will collaborate closely with a talented cadre of security specialists and incident responders to react urgently to security events . Your observations and recommendations will impact security decisions across the organization, and play an important part in maturing Citi's security posture.
As an individual contributor, you will be a hands-on first responder who triages and investigates cybersecurity incidents in cloud, traditional (i.e. on-premises) , and hybrid environments. This position will be technically challenging and rewarding, but will also provide ample opportunity to establish partnerships, mentor colleagues and shape team culture. One guarantee is that no two days will be the same.
Responsibilities
Related activities include but are not limited to:
- Lead and/or support in-depth triage and investigations of urgent cyber incidents in cloud, traditional, and hybrid environments.
- Perform incident response functions including but not limited to host-based analytical functions (e.g. digital forensics, metadata, malware analysis, etc.) through investigating Windows, Unix based, appliances, and Mac OS X systems to uncover Indicators of Compromise (IOCs) and/or Tactics, Techniques and Procedures (TTPs).
- Create and track metrics based on the MITRE ATT&CK Framework and other standard security-focused models.
- Work with application and infrastructure stakeholders to identify key components and information sources such as environments (on-premises versus cloud) , servers, workstations, middleware, applications, databases , logs, etc.
- Participate in incident response efforts using forensic and other custom tools to identify any sources of compromise and/or malicious activities taking place.
- Collaborate with global multidisciplinary groups for triaging and defining the scope of large scale incidents.
- Document and present investigative findings for high profile events and other incidents of interest .
- Participate in readiness exercises such as purple team, table tops, etc .
- Train junior colleagues on relevant best practices .
A skilled and creative incident responder . Success will depend on your ability to:
- Stay current with the evolving landscape of threat activities and cybersecurity best practices.
- Quickly synthesize information from disparate sources.
- Scrutinize evidence thoroughly to identify relationships and develop leads.
- Establish defensible working theories to explain observations and findings.
- Perform investigations in a forensically sound manner.
- Stay motivated and work independently with minimal oversight.
- Adapt to changing requirements in a fast paced environment.
- Multitask and meet deadlines despite competing priorities.
- Navigate operational impediments in order to complete time sensitive tasks.
- Identify and document any opportunities for process improvement.
- Practice mutual respect at all times.
- Establish trust and build strong partnerships.
- Resolve conflict in a constructive manner and use as an opportunity to develop team unity.
- Prioritize collective success ahead of individual ambition.
- Establish clear narratives to describe investigative findings and working theories.
- Clearly and concisely articulate any recommendations that arise from investigative activities.
- Motivate colleagues and partners to cooperate and support as needed.
- Exert influence both verbally and in writing.
- Lead by example.
- Enable team success by being approachable and available.
- Innovate and inspire others.
- Embrace challenges and approach any failures as opportunities for learning and improvement .
Education, knowledge, and Experience:
- Bachelor's degree in a technically rigorous domain such as Computer Science, Information Security, Engineering, Digital Forensics, etc.
- 3+ years of professional experience in cybersecurity and/or information security, or demonstrated equivalent capability.
- 1+ years hands-on working in cyber incident response and investigations in medium to large organizations with cloud and forensics components.
- Hands-on Dev/Sec/Ops experience with cloud environments and underlying storage, compute and monitoring services
- Prior experience with cloud common services
- Hands-on experience with forensic investigations or large scale incident response in cloud environments.
- Hands-on experience with containerization methods and tools (e.g. Docker, Kubernetes) including incident response and digital forensics .
- Certifications (e.g. GIAC, AWS, etc) in cloud or demonstrated equivalent capability.
- Hands-on experience with analyzing and pivoting through large data sets
- Current hands-on experience in digital forensics (e.g. computer, network, mobile device forensics, and forensic data analysis, etc.).
- Activities include but not limited to:
- Memory collection and analysis from various platforms
- Evidence preservation, following industry best practices .
- Familiarity with malware analysis and Reverse Engineering of samples (e.g. static, dynamic, de-obfuscation, unpacking)
- In-depth File system knowledge and analysis.
- In-depth experience with timeline analysis.
- In-depth experience with Registry, event, and other log file and artifact analysis.
- Activities include but not limited to:
- Hands-on experience with a DFIR toolset and related scripting
- Current expertise with an EDR system
- One or more GIAC (e.g. GCFE, GCFA, GREM, GCIH, GASF, GNFA, etc.) or other digital forensic and/or incident response certifications.
- Windows Operating Systems / UNIX / Mac OS X, specifically in system administration, command line use, and file system knowledge.
- Proficient in basic scripting and automation of tasks (e.g. C/C++, Powershell, JavaScript, Python, bash, etc.).
- Working knowledge of networking protocols and infrastructure designs; including routing, firewall functionality, host and network intrusion detection/prevention systems, encryption, load balancing, and other network protocols.
- Working knowledge of relational database systems and concepts (SQL Server, PostgreSQL, etc.)
- Working knowledge of virtualization products (e.g. VMware Workstation)
- Must have flexibility to work outside of normal business hours when necessary.
- Exceptional candidates from non-traditional backgrounds or who otherwise do not meet all of these criteria may be considered for the role provided they demonstrate sufficient skill and experience.
Job Family Group:
Technology
------------------------------------------------------
Job Family:
Information Security
------------------------------------------------------
Time Type:
Full time
------------------------------------------------------
Citi is an equal opportunity and affirmative action employer.
Qualified applicants will receive consideration without regard to their race, color, religion, sex, sexual orientation, gender identity, national origin, disability, or status as a protected veteran.
Citigroup Inc. and its subsidiaries ("Citi) invite all qualified interested applicants to apply for career opportunities. If you are a person with a disability and need a reasonable accommodation to use our search tools and/or apply for a career opportunity review Accessibility at Citi .
View the " EEO is the Law " poster. View the EEO is the Law Supplement .
View the EEO Policy Statement .
View the Pay Transparency Posting
-
Soc incident responder
4 weeks ago
Singapore Citi Full timeAs a bank with a brain and a soul, Citi creates economic value that is systemically responsible and in our clients’ best interests. Our Enterprise Operations & Technology teams are charged with a mission that rivals any large tech company. Our technology solutions are the foundations of everything we do. We keep the bank safe and provide the technical...
-
Soc incident responder
3 weeks ago
Singapore Citigroup Full timeAs a bank with a brain and a soul, Citi creates economic value that is systemically responsible and in our clients’ best interests. As a financial institution that touches every region of the world and every sector that shapes your daily life, our Enterprise Operations & Technology teams are charged with a mission that rivals any large tech company. Our...
-
Cybersecurity Specialist
2 weeks ago
Singapore ITCAN PTE. LIMITED Full timeJob Title: Cybersecurity Specialist - Incident ResponderAbout the Role:We are seeking an experienced Cybersecurity Specialist to join our team as an Incident Responder. As a key member of our Security Operations Center (SOC), you will be responsible for monitoring security sensors, reviewing logs, and identifying network anomalies or intrusions.Duties and...
-
Cyber Incident Responder
4 months ago
Singapore UBS Full timeYour role Are you keen on working in world class Cyber Security Operations Center for one of the best Swiss private banks? Do you have related experience and are willing to take it further by learning how to defend an enterprise against cyber-attacks? We are looking for an incident response expert who will: • respond to cyber security incidents covering...
-
Cyber incident responder
2 weeks ago
Singapore This Is An IT Support Group Full timeOur client, a company specialising in providing high-end security consulting and incident response support to organizations worldwide, is looking for a Cyber Incident Responder to join their team in Singapore.Main Responsibilities Participate in forensic and incident response investigations, including large scale sophisticated attacks, conduct log analysis,...
-
SOC Analyst
3 weeks ago
Singapore CAREERALLY PTE. LTD. Full timeRoles & ResponsibilitiesThe SOC Analyst will be responsible for monitoring, detecting, and responding to security threats and incidents in a 24/7 Security Operations Center.Responsibilities: Continuously monitor and analyze system activities and security alerts from SIEM and EDR tools to identify malicious activity. Analyze security events to identify and...
-
Singapore ITCAN PTE. LIMITED Full timeRoles & Responsibilities· Act as Incident first responder for a 24/7 staffed SOC.· Monitor security sensors and review logs to identify network anomalies or intrusions.· Perform initial analysis of security alerts.· Escalate security incidents using established policies and procedures in a timely manner.· Work with customers to analysis potential...
-
APAC SOC Operations Team Lead
2 weeks ago
Singapore Proficio Full timeAbout ProficioProficio is a leading provider of managed detection and response (MDR) services. We specialize in 24/7 security monitoring, investigation, alerting, and response for organizations across various industries.We have been recognized by Gartner's Market Guide for Managed Detection and Response Services for three consecutive years. Our innovative...
-
Employment opportunities
3 weeks ago
Singapore ITCAN PTE. LIMITED Full timeRoles & Responsibilities· Act as Incident first responder for a 24/7 staffed SOC.· Monitor security sensors and review logs to identify network anomalies or intrusions.· Perform initial analysis of security alerts.· Escalate security incidents using established policies and procedures in a timely manner.· Work with customers to analysis potential...
-
Cybersecurity Team Lead for Incident Response
2 weeks ago
Singapore Singtel Full timeAbout the Role:We are seeking a seasoned Cybersecurity Team Lead to oversee our Security Operations Center (SOC). As a key member of our team, you will be responsible for driving goals and performance for SOC analysts, managing time off requests, and other HR-related tasks.Key Responsibilities:Serve as team lead, driving goals and performance for SOC team...
-
Cybersecurity Expert
4 days ago
Singapore Snaphunt Full timeAbout SnaphuntSnaphunt has established itself as a niche player in connecting various applications, bridging the gap between mobile and web frontends to traditional ERP systems through middleware. Its unique value proposition lies in its expertise and ability to facilitate seamless cross-application connectivity.As an outsourced IT arm, Snaphunt has built a...
-
Soc manager
3 weeks ago
Singapore Randstad Full timeSoc Manager (Splunk) in Singapore Job Details Location: Singapore Specialism: Information Technology Job Type: Permanent Working Hours: Full-Time Salary: S$ 12,000 - S$ 16,000 per month Reference Number: 91 M0153772_1617018387 Contact: Josh Lim, Randstad Job Description About the Company: My client is a market leader in its industry. They are well...
-
Soc manager
1 week ago
Singapore Randstad Full timeSoc Manager (Splunk) in SingaporeJob DetailsLocation:Singapore Specialism:Information Technology Job Type:Permanent Working Hours:Full-Time Salary:S$ 12,000 - S$ 16,000 per month Reference Number:91 M0153772_1617018387Contact:Josh Lim, Randstad Job DescriptionAbout the Company: My client is a market leader in its industry. They are well established and have...
-
Soc lead gurgaon or bangalore, india
3 days ago
Singapore Tbwa ChiatDay Inc Full timeAspire is the leading all-in-one finance operating system for growing businesses in APAC. We are on a mission to reinvent business finance for a new generation of entrepreneurs and business owners, empowering startups and MSME to realise their full potential. Founded in 2018, Aspire has raised over USD 300 M+ across equity and debt from world-class...
-
Security Operations Center Analyst
1 month ago
Singapore TEKsystems (Allegis Group Singapore Pte Ltd) Full timeJob Title: SOC AnalystThe L2/L3 SOC Analyst is a critical role that requires a unique blend of technical expertise and soft skills. As a key member of our security operations team, you will be responsible for responding to security events, collaborating with teams to implement corrective actions, handling incident requests per SIRT protocols, and meeting...
-
L1 SOC Analyst
1 week ago
Singapore Eames Consulting Full timeAre you an up-and-coming IT professional with network operations or cyber security operations experience, and looking for your next career move? If so, you could be the L1 SOC Analyst our client is looking for! As L1 SOC Analyst, you will be responsible for: Performing cyber security monitoring and performing basic incident triaging Performing root cause...
-
Senior SOC Cyber Threat Analyst
2 months ago
Singapore Citi Full timeWe are seeking a highly skilled and experienced Senior SOC Analyst to join our Cyber Threat team in the Security Operations Center (SOC). The Global SOC operates in a 24x7, follow the sun model and is the firm's first line of defense against evolving cyber threats, ensuring the safety and integrity of our digital assets. This role requires an individual with...
-
SOC analyst level 1
3 weeks ago
Singapore ITCAN PTE. LIMITED Full timeRoles & ResponsibilitiesSOC Level 1 Monitor security sensors and review logs to identify network anomalies or intrusionsPerform initial analysis of security alertsEscalate security incidents using established policies and procedures in a timely...
-
Cybersecurity Analyst/Engineer Position
4 weeks ago
Singapore Snaphunt Full timeThe OpportunityJoin Snaphunt's team as a Cybersecurity Analyst/Engineer, where you will be responsible for monitoring and responding to security incidents within our SOC or CSIRT environment.The RoleYou will analyze security events using frameworks like MITRE ATT&CK and OWASP to identify threats and vulnerabilities, conduct malware and exploit analysis, and...
-
Information Security Specialist
2 weeks ago
Singapore Steenbok Full timeAbout SteenbokWe are a renowned IT solutions provider with extensive experience in connecting applications from mobile and web frontends to traditional ERP systems through middleware.Our core value lies in our expertise and ability in cross-application connectivity, making us a trusted partner for industries seeking reliable outsourced IT services.The...
