I52 - Security Analyst (120)

Description

The Security Analyst is responsible for administering, maintaining and continuously improving the security controls of Income Insurance Limited's (Income) enterprise security tools, including the Google Security Operations (SecOps) platform, Network Traffic Analysis (NTA) and Gigamon visibility tools, and Endpoint Detection and Response (EDR). The role ensures these platforms remain healthy, correctly configured and tuned to detect and contain current and emerging cyber threats across on-premises, cloud and hybrid environments. He/She will also lead security tool integration, technology refresh and improvement projects, working closely with IT infrastructure and application teams, business units, the managed SOC and product vendors to protect Income's confidential information.

This security systems administration and operations role sits within the IT Risk and Security Department and reports to the Security Operations Manager.

Key Responsibilities

• Security tool administration: Administer, configure and maintain Income's security tools, including Google SecOps, NTA and Gigamon tools, EDR, Intrusion Prevention System (IPS) and Database Activity Monitoring (DAM). This covers policy and rule configuration, agent and sensor deployment, log-source onboarding, user access management, upgrades, patching, and health and availability monitoring.
• Control improvement and tuning: Continuously review and improve tool configurations, detection rules, prevention policies and exclusions to reduce false positives, close detection gaps and align controls with the MITRE ATT&CK framework and current threat intelligence.
• Visibility and coverage: Ensure complete and reliable security telemetry for on-premises and cloud assets by onboarding new log sources, endpoints and network segments, validating data quality, parsing and retention, and tracking coverage gaps to closure.
• Threat detection and containment: Support the managed SOC and incident response team by using SIEM, EDR and NTA capabilities to investigate, isolate and contain threats, and implement control improvements arising from incidents, red team exercises, table-tops and post-incident reviews.
• Security control assessment: Analyse, assess and evaluate security controls for systems deployed on-premises and in the cloud, provide visibility into the security posture of these assets, and recommend improvements to strengthen Income's cyber defence.
• Automation and AI: Apply automation, SOAR and AI-driven capabilities to streamline repetitive administration and response tasks, consolidate and integrate security controls, and reduce management complexity and cost, with appropriate validation of outputs.
• Reporting and metrics: Use SIEM and analytics tools to produce insightful operational and management metrics on tool health, detection coverage, alert trends and control effectiveness for weekly, monthly and quarterly reporting.
• Technology refresh and evaluation: Plan and perform technology refresh of security tools when required, and evaluate emerging cyber security products through proofs of concept, translating them into feasible solutions for the organisation.
• Project management: Take ownership of assigned security projects as project manager, adhering to Income's Procurement and Project Management frameworks to gather security control requirements, deliver projects on time, and transition them into operations with IT infrastructure, application teams and business units.
• Vendor and contract management: Manage product vendors and maintenance support contracts, including licence tracking, renewals, ITQ/RFP preparation and monitoring of vendor deliverables.
• Governance and documentation: Ensure security tool changes follow Income's change, access and configuration management processes, and maintain SOPs, configuration baselines and evidence to support audits and MAS Technology Risk Management (TRM) requirements.
• Perform other duties as assigned by the Security Operations Manager.

Qualifications

• Education and experience: Bachelor's degree in Cybersecurity, Information Technology, Computer Science or a related discipline preferably in Financial Services or a regulated environment.
• Tool administration: Minimum of 4 years of hands-on experience administering enterprise security tools as a security administrator, security analyst, security engineer or similar role in a medium-to-large enterprise.
• SIEM: Practical experience administering Google Security Operations SIEM including log-source onboarding and parsing, detection rule development and tuning, dashboards and reporting, is a strong advantage.
• EDR: Practical experience with EDR policy configuration, sensor deployment and health monitoring, exclusion management, prevention tuning and host containment.
• Network visibility: Experience with NTA and Gigamon or similar network packet brokers, including traffic mirroring and TAP configuration, sensor placement, traffic decryption and investigation of network anomalies. Experience with IPS, Proxy and firewalls is an advantage.
• Network security: Good knowledge of IT network security (secure LAN, WAN, vLAN, MPLS, secure network zoning, micro-segmentation and restricted network design) and of cyber security tools and solutions with AI and ML capabilities.
• Systems and cloud: High proficiency in Unix/Linux, Mac and Windows operating systems and virtualisation technologies such as VMware and Microsoft Hyper-V, with working knowledge of cloud security in AWS, Azure or Google Cloud.
• Automation: Ability to use scripting (e.g. Python, PowerShell), APIs and automation or SOAR tools to integrate security controls and streamline operational tasks.
• Governance: Familiarity with change, access, configuration and vendor-management processes. Knowledge of MAS TRM Guidelines, the MAS Cyber Hygiene Notice, the NIST Cybersecurity Framework and MITRE ATT&CK is an advantage.
• Certifications: Relevant industry certifications such as CISSP, CISM, CISA, GIAC (e.g. GCIA, GCED), CCSP, PMP, or vendor certifications for SIEM, EDR or network visibility tools are preferred.

Competencies

• Strong written and verbal communication skills, with the ability to explain security and risk-related concepts clearly to technical and non-technical audiences.
• Strong analytical and troubleshooting skills, with attention to detail and ownership of platform health and control effectiveness.
• Works well under pressure, prioritises effectively and meets tight deadlines, including during security incidents.
• Able to work independently and collaboratively with internal teams, the managed SOC and vendors.
• A passion for information and data security, with a commitment