Job details
Salary up to $162,500 a year job type full-time
Full job description
At american family insurance, we believe people are an organization’s most valuable asset, and their ideas and experiences matterFrom our ceo to our agency force, we’re committed to growing a diverse and inclusive culture that empowers innovation that will inspire, protect, and restore our customers’ dreams in ways never imagined.
American family insurance is driven by our customers and employeesThat’s why we provide more than just a job – we provide opportunityWhether you’re already part of our team in search of a new challenge or new to our company and ready for what’s next, you’re in the right placeEvery dream is a journey that starts with a single stepStart your journey right hereJoin our teamBring your dreams.
Job id:
R24589 cyber security incident commander - open to remote (open)
Compensation may vary based on the job level and your geographic work location.
Compensation minimum:$101,500
Compensation maximum:$162,500
Summary:
The cyber security incident commander investigates, analyzes, and responds to cyber incidents within the enterprise cyber environmentThey will collect intrusion artifacts (e.g., source code, malware, trojans) and use discovered data to enable mitigation of potential cyber incidents within the enterpriseProvides leadership and expertise as it relates to emerging cyber threats and actionable intelligenceThe role will be responsible to manage and lead enterprise teams to contain and eradicate malicious behavior and lead follow up conversations to ensure we maintain customer trust and protect the brand.
Job description:
Job level summary
Requires specialized depth and/or breadth of expertise in own job discipline or field.
Leads others to solve complex problems.
Works independently, with guidance in only the most complex situations.
May lead functional teams or projects.
Primary accountabilities
Ability to lead large complex csirp activities
Perform incident triage, to include determining scope, urgency and potential impact; identifying specific vulnerability and making recommendations that enable expedition remediation
Coordinate and provide expert technical support to enterprise-wide cyber defense technicians to resolve cyber defense incidents.
Serve as a technical expert and liaison to law enforcement personnel and other internal teams, and explain incident details as required
Track and document incidents from initial detection through final resolution and closure
Write and publish after actions reviews
Researches and analyzes emerging cyber threats and threat intelligence from a number of sources and relevant cyber-intelligence feedsContextualizes finding to company`s specific business risks or vulnerabilities.
Monitors sources and feeds for indicators of information security threats and analyzes such threats to provide actionable intelligence.
Act as a point of escalation for security investigations and incidents to provide guidance and oversight on incident resolution and containment techniques
Rapidly cycle through discovering gaps, identifying solutions, and developing simplified approaches for delivering and integrating security solutions into the security and it ecosystems
Develop dashboards and reports to identify potential threats, suspicious/anomalous activity, malware, etc.
Security research and development
Maintaining ongoing knowledge of cyber threat actors and their tools, techniques and procedures.
Develops technical proof of concepts related to attacks involving web applications, mobile applications, network, hardware, internet of things and social engineering.
Conduct threat hunting exercises.
Simulate real-world attacks on company assets to uncover defensive control weaknesses
Continually enhances skills and build knowledge in all aspects of the organization, the business and information systems
Uncovering the unknown about cyber security threats and threat actors.
Cyber security leadership
Interfacing with other teams in information security (security operations, incident response and vulnerability management) along with information risk officers and technology management to help guide cyber security strategy.
Drives reduction of high risk vulnerabilities by regularly communicating with stakeholders and management.
Provides direction and thought leadership in the cyber security and threat landscape space.
Interface into business units to bring business context to cyber security threat management practices, security controls and threat reporting etc, as needed
Researches and communicates needed configuration standards in response to ever changing threat landscapeDemonstrates innovation and agility in the mitigation of data exposure.
Partner with information security operations to provide leadership and support in the areas of threat analysis, cyber defense techniques and approaches
Interface with affiliates, industry peers, government and law enforcement organizations as appropriate to acquire and share information
Provides direction, expertise, feedback, coaching and development to build the capability of more junior staff
Provide expert analytic investigative support of large scale and complex security incidents
Specialized knowledge & skills requirements
Demonstrated experience providing customer-driven solutions, support or service.
Solid knowledge and understanding of software engineering architectures, system/software designs, and system deployments.
Working knowledge and of cyber security, cyber engineering, computer science, software engineering, electrical / computer engineering.
Extensive knowledge and understanding of security technologies and application development methodologies.
Demonstrated experience performing cyber threat analysis, incident response, forensics analysis, penetration testing, and ethical hacking.
Extensive knowledge and understanding of directory services and identity stores.
Education & licenses
Bachelor`s degree in computer science, information assurance, mis or related field, or equivalent work experience.
Travel requirements
This position requires travel up to 10% of the time.
Additional job information:
Strongly preferred skills:
Knowledge of computer networking concepts and protocols, and network security methodologies.
Knowledge of cyber threats and vulnerabilities.
Knowledge of cybersecurity principles.
Knowledge of national and international laws, regulations, policies, and ethics as they relate to cybersecurity.
Knowledge of risk management processes (e.g., methods for assessing and mitigating risk).
Knowledge of specific operational impacts of cybersecurity lapses.
Knowledge of basic system administration, network, and operating system hardening techniques.
Knowledge of cloud service models and possible limitations for an incident response.
Knowledge of cyber defense policies, procedures, and regulations.
Knowledge of different classes of attacks (e.g., passive, active, insider, close-in, distribution).
Knowledge of different operational threat environments (e.g., first generation [script kiddies], second generation [non- nation state sponsored], and third generation [nation state sponsored]).
Knowledge of disaster recovery continuity of operations plans.
Knowledge of general attack stages (e.g., foot printing and scanning, enumeration, gaining access, escalation or privileges, maintaining access, network exploitation, covering tracks).
Knowledge of how network services and protocols interact to provide network communications.
Knowledge of incident categories, incident responses, and timelines for responses.
Knowledge of incident response and handling methodologies.
Knowledge of intrusion detection methodologies and techniques for detecting host and network-based intrusions via intrusion detection technologies.
Knowledge of malware analysis concepts and methodologies.
Knowledge of network protocols such as tcp/ip, dynamic host configuration, domain name system (dns), and directory services.
Knowledge of network security architecture concepts including topology, protocols, components, and principles (e.g., application of defense-in-depth).
Knowledge of osi model and underlying network protocols (e.g., tcp/ip).
Knowledge of system and application security threats and vulnerabilities (e.g., buffer overflow, mobile code, cross-site scripting, procedural language/structured query language [pl/sql] and injections, race conditions, covert channel, replay, return-oriented attacks, malicious code).
Knowledge of what constitutes a network attack and the relationship to both threats and vulnerabilities.
Skill in performing damage assessments.
Skill in preserving evidence integrity according to standard operating procedures or national standards.
Skill in protecting a network against malware.
Skill in recognizing and categorizing types of vulnerabilities and associated attacks.
Skill in securing network communications.
Skill in using security event correlation tools.
Skill of identifying, capturing, containing, and reporting malware.
Knowledge of an organization`s information classification program and procedures for information compromise.
Knowledge of data backup, types of backups (e.g., full, incremental), and recovery concepts and tools.
Knowledge of host/network access control mechanisms (e.g., access control list).
Knowledge of network traffic analysis methods.
Knowledge of packet-level analysis.
Knowledge of the common networking and routing protocols(e.gTcp/ip), services (e.g., web, mail, dns), and how they interact to provide network communications.
Depending on qualifications, open to hiring at a higher level or lower level.
There are two positions available.
This position does require rotational on-call 24/7/365.
When you work at american family you can expect benefits that support your physical, emotional, and financial wellbeingYou will have access to comprehensive medical, dental, vision and wellbeing benefits that enable you to take care of your healthWe also offer a competitive 401(k) contribution, a pension plan, an annual incentive, and a paid-time off programIn addition, our student loan repayment program and paid-family leave are available to support our employees and their familiesInterns and contingent workers are not eligible for american family enterprise benefits.
We also consider qualified applicants with criminal histories, consistent with applicable federal, state and local law.
Stay connected: join our enterprise talent community!
Li:jm1
