Cyber Defense Analyst II

AIG

American International Group, Inc, (AIG), is a global insurance organization providing a range of insurance and other financial services. Get to know us better.

Position Description:
A cyber defense analyst will be responsible to execute a range of threat discovery duties including advanced SIEM analytics, packet analysis and digital forensics. This person will work as part of a team that conducts investigations into potential and actual cyber-attacks affecting AIG’s global business units, lines of business, or information technology infrastructure.

Position Responsibilities:
• Analyze reports, dashboards, and alerts to provide operational oversight of the security posture of the enterprise environment.
• Monitor and address all service tickets and digital correspondence coming into the queue(s) and engage resources as appropriate to resolve any outstanding issues.
• Support peers and senior personnel with documentation and metrics in a force multiplier role.

Minimum Requirements (Knowledge, Skills, and Abilities):
• Malware & Hacking Analysis - General knowledge of malware + worm + virus trends and behavior and the ability to work with teams to execute eradication procedures. Ability to identify various tactics, techniques and procedures and familiarity with sandbox detonation and interpreting results.
• Network & Packet Analysis - Ability to create a PCAP for network traffic using on-prem tools, interpret packet header information, and trace host & user network behavior using on-prem tools.
• Phishing Triage - Ability to analyze message headers and identify actionable indicators for remediation. Conduct research & correlation analysis on domain registrations and familiarity with sandbox detonation and interpreting results.
• Project Management - Ability to complete a project action item.
• SIEM Support - Ability to conduct temporal analysis on a given data field.
• Threat Intelligence - Contextualize threat intelligence reports and create indicators and demonstrate proficiency in attribution research using 3rd-party or on-prem tools.

Experience:
Minimum of one (1) year of experience in Information Security, and at least one (1) year of practical experience in a Security Operations Center (SOC) environment and/or experience with security monitoring, event and anomaly analysis and intrusion detection/prevention.

Formal Education & Certification:
** NOTE: An equivalent combination of experience, education and/or training may be substituted for the listed requirements.

Working Conditions:
The analyst will be expected to perform shift work as part of a 24x7 global team, occasionally requiring weekend and off-hours work.