CASY-MSCCN Jobs

Ankura is a team of excellence founded on innovation and growth.

OVERVIEW:

Cybersecurity Directors support the first line of defense at our Security Operations Center (SOC). This is a Director (Manager) level role that provides expert Network and Endpoint Security analysis for Ankura's portfolio of clients in a 24x7 operational setup. Directors actively review alerts, work on escalations, incidents, and behaviors reported from a variety of security platforms and conduct a deeper investigation of events and other data elements for possible threats, and engage in Incident Response by taking ownership of the incidents and leading the investigations.

Location: Conditional Remote / GurgaonHours: 40 hours a weekReporting: Director - Threat Detection Operations (TDO)

ABOUT US:

Ankura: Ankura Consulting Group is recognized as one of the five fastest-growing consulting companies, with 1,500 employees across 32 offices in 4 continents. The Company provides services to its client on expert witness, bankruptcy and corporate restructuring, litigation support, forensic accounting, geopolitical risk assessment, and general management consulting services. Ankura Consulting Group's headquarters is based in Washington, USA.

Practice: The Managed Data Protection Services is part of the Global Cyber Security and Privacy vertical.

SUMMARY

• Duties include providing On-Job Training to fellow Senior Analysts and Analysts, continuous monitoring of Security Information Event Management (SIEM), EDR, and related platforms for correlated events and alerts and working with the client to take action. Senior Analysts leverage events to determine the impact, document possible causes, and provide useful information to clients.

• A deep understanding of various commercial and open-source network sensors, intrusion detection systems, and event log correlation engines is required as senior analysts are expected to deliver enhanced threat awareness and knowledge through research and continuous improvement of use cases, signatures, and metrics.

• Expected to help automate anomaly detection and alerting while documenting security incidents, processes, investigations, and remediation efforts.

• Usually, employees will be permitted to work remotely in the current operational setup however that setup may change based on company and/or business needs, with or without notice. It may also be considered a conditional privilege as the employees are personally responsible to maintain uninterrupted availability and communication via all official channels throughout their designated shifts. If the employee's performance cannot be satisfactorily ascertained by their manager or the employee is unable to adapt to work without disturbance, they may be called upon to work out of the company’s office.

CAPABILITIES

• Must have formal training and experience in delivering Managed Security or Managed Detection and Response Services along with Supervisory Capabilities.

• Must have a sound understanding and up-to-date knowledge of common security threats, attack vectors, vulnerabilities, exploits, and Network Architecture / Protocols (such as OSI, TCP/IP, P2P, etc.) and Packet and Process Analysis.

• Must have hands-on experience to correlate and analyze information, raw logs, and complex data sets from a wide variety of enterprise technologies including but not limited to SIEM, UEBA, EDR, IDS, IPS, Proxy, Firewall, DLP, and other Threat intelligence tools and Telemetries for anomalous activity and items of interest.

• Must have the necessary experience to conduct initial triage and in depth analysis of security events and incidents; determine the priority, criticality, and impact; facilitate communication within the SOC, escalate to the client for containment and remediation, and document/journal progress throughout the Incident Response Lifecycle within the respective service level objectives.

• Required to have experience in conducting research analysis and data gathering requirements to present in a report format.

• Ability to develop and follow standard processes and complete documentation as needed.

• Must be flexible enough to work in a 24x7 rotational shift setup, including overnight, weekend, and national holidays.

TECHNICAL

• Elastic, Logstash, Kibana.

• Traditional SIEM ArcSight ESM.

• Emerging SIEM such as MS Azure Sentinel, Exabeam, Obsidian.

• Snort / Suricata / Zeek / Wireshark.

• Endpoint awareness for Carbon Black, CrowdStrike, SentinelOne, MS Defender.

• Open source frameworks like Security Onion.

• Understanding of KQL, Lucene, Python, and/or other similar programming/query/scripting languages

EDUCATION, TRAINING & CERTIFICATIONS

• Preferred to have a degree in CS/IT or a Masters's Diploma in the field of IT Security from specialized schools like CDAC along 8+ Year of relevant.

• Preferred to have relevant entry-level or mid-level security certifications such as CEH, Security+, etc..

COMMUNICATION

• Comfortable working in a remote work environment including web-based team management and collaboration applications, and time-keeping systems e.g. Slack, Microsoft Teams, Intapp, and Workday.

• Ability to communicate complex ideas effectively, both verbally and in writing in English and the local office language(s)

• Able to provide reports showing progress or achievement of assigned goals and responsibilities as required.

• Must be an active listener and ask questions of others when clarity is needed

• Ability to gain an understanding of client needs and apply analytic reasoning

• Demonstrates proactive engagement in meetings and process discussions

KEY PERFORMANCE INDICATORS

• Analyze client networks for threats using analytical platforms for event monitoring such as NSM, SIEM, UEBA, ETDR.

• Deliver client reports based on analyses that are timely, high quality, and accurate.

• Understand and support incident response and triage

• Improve reporting to avoid ‘analysis paralysis’.

• Develop new skills within analytical platforms

INDIVIDUAL & TEAMWORK

• Must be able to effortlessly switch between independent and team-based work

• Understands that the work product is dependent on team efforts and remains responsive to internal and external deadlines

• Able to share expertise and experience with team members to encourage growth and shared success

• Able to maintain focus and attention to detail for sustained periods of time

• Engaged in supporting the development and growth of all team members

GROWTH MINDSET

• Can receive and provide feedback in a constructive manner that leads to the growth of self and others.

• Displays perseverance of effort and passion for a long-term goal and end state.

• Works well under timelines and puts in extra effort as required to meet timelines.

• Self-motivated to identify areas for team & process improvement and collaborate with others to develop creative solutions

LEADERSHIP TRAITS

• Willing to adapt leadership skills to support larger and more complex projects.

• Work product for self and team is consistently of excellent quality and efficiency.

• Respectful and professional in all interactions with team members, clients, and colleagues.

• Maintains composure and calm disposition under high-pressure or stressful circumstances.

  #LI-JK1

Ankura is an Affirmative Action and Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, or protected veteran status and will not be discriminated against based on disability. Equal Employment Opportunity Posters, if you have a disability and believe you need a reasonable accommodation to search for a job opening, submit an online application, or participate in an interview/assessment, please email accommodations@ankura.com or call toll-free +1.312-583-2122. This email and phone number are created exclusively to assist disabled job seekers whose disability prevents them from being able to apply online. Only messages left for this purpose will be returned. Messages left for other purposes, such as following up on an application or technical issues unrelated to a disability, will not receive a response.

Ankura Consulting Group, LLC is an independent global expert services and advisory firm that delivers services and end-to-end solutions to help clients at critical inflection points related to conflict, crisis, performance, risk, strategy, and transformation. The Ankura team consists of more than 1,800 professionals serving 3,000+ clients across 55 countries who are leaders in their respective fields and areas of expertise. Collaborative Lateral Thinking That Deliversᵀᴹ, hard-earned experience, expertise, and multidisciplinary capabilities drive results and Ankura is unrivalled in its ability to assist clients to Protect, Create, and Recover Valueᵀᴹ. For more information, please visit, ankura.com.