Apply on Employer Site

American Express · 18 hours ago

Senior Associate - CyberOps & Assurance (Incident Response)

United States

Full-time

Remote

Mid, Senior Level

$89K/yr - $150K/yr

1+ years exp

American Express is a company built on a 175-year history of innovation and commitment to its customers. They are seeking a passionate and experienced security analyst for their security operations & incident response team to perform incident response activities and protect their brand from advanced threats.

Credit CardsFinanceFinancial ServicesPaymentsTravel

Comp. & Benefits

No H1B

Responsibilities

Perform triage and analysis for cyber security events across multiple platforms using data across diverse sources (e.g., firewalls, EDR, IDS/IPS, identity, application logs)

Recognize attacker tactics, techniques, and procedures as well as Indicators of Compromise (IOCs) / Indicators of Attack (IOAs) that can be applied to current and future investigations

Investigate and respond to cyber security incidents, supporting all stages of the incident lifecycle including identification, containment, eradication, and recovery efforts

Contribute to team projects, process improvement, and development of new capabilities

Curate a world class security operations and incident response team with a relentless focus on innovation and continuous improvement

Assess and develop incident response best practices to help mature the overall security operations of the organization

Make recommendations for improving enterprise risk posture based on individual research and technical expertise

Stay current on industry trends, attack techniques, mitigation techniques, and security technologies

Produce high-quality written and verbal reports, recommendations, and actions

Qualification

Incident ResponseLog AnalysisSecurity ToolsNetwork ProtocolsOperating SystemsSecurity CertificationsAnalytical SkillsDocumentation SkillsCommunication Skills

Required

1-3 years of experience in information security

Solid foundation of network and application protocols and concepts (tcp, ip, dns, http, dhcp, etc)

Experience with various network and/or host-based security tools to detect and respond to security events

Experience with log analysis using SIEM/SOAR platforms

Theoretical and practical security knowledge and investigation experience with Mac, Linux, and Windows operating systems, as well as cloud environments

Theoretical and practical knowledge in Incident Response lifecycles

Strong analytical, documentation, and communication skills

Applicable certifications such as Security+, CySA+, GSEC, GCIH, GCIA, CEH, CISSP