Cybersecurity Engineer (Incident Response)

About the role

Assurity Trusted Solutions (ATS), a wholly owned subsidiary of the Government Technology Agency (GovTech), is looking for a Cybersecurity Engineer with a background in Incident Response to join its Cyber Incident Response Team (CIRT). The successful candidate ensures the delivery of cybersecurity operations services across all stages of the incident response lifecycle, from triaging potential security events to advising on containment, eradication and recovery.

Key responsibilities

• Lead incident response through all phases: triage and investigation of potential incidents to determine scope and severity, and develop and execute containment strategies.
• Perform investigations and root cause analysis to identify attack vectors, tactics and impact.
• Analyse security event logs across endpoint systems, EDR telemetry, network traffic, application logs, cloud service logs and audit trails to validate detections and identify attacks.
• Conduct digital forensic acquisition and analysis of artifacts from endpoints, servers, network devices, cloud environments, mobile devices and storage media.
• Maintain stakeholder communication throughout the incident and prepare post-incident reports with preventive recommendations.
• Provide expert input for automating Security Operations, such as implementing SOAR playbooks, and develop and test incident response playbooks and processes.
• Maintain situational awareness of the cyber security landscape and emerging threat actor TTPs.

Required profile

• Bachelor's degree in Computer Science, Information Security or equivalent.
• Professional certifications such as GCFA, GREM, GNFA, GCTI or CISSP preferred.
• Preferably 5 years or more of experience as a full-time incident responder, digital forensics analyst, malware analyst or in a related discipline.
• Good communication and interpersonal skills, with the ability to multitask and prioritise.

Required skills

• Understanding of operating systems (Windows, Linux) and computer networking, LAN and server.
• Proficiency with forensic tools such as AXIOM, FTK or Autopsy.
• Ability to perform basic static and dynamic malware analysis and to analyse network and application logs.
• Good working knowledge of cloud and container technologies is a plus.