Incidence Response Analyst at Ecobank Ghana

• Serves as a level 3 investigator, functional expert, and/or team member at the Senior experience level conducting advanced analysis and investigations to detect and remove unauthorized, malicious, or adversary presence from operational systems, networks, or applications, databases, and cloud resources to ensure reliability and availability of mission critical services.
• Monitor and respond to security events and incidents using established processes, creating process and procedures where none are already established.
• Coordinate the response to security incidents, ensuring all necessary stakeholders are involved and appropriate actions are taken. Work closely with internal teams, such as Applications, network operations, and service desk, to ensure a coordinated and effective response.
• Take immediate action to contain and mitigate security incidents to prevent further damage. Develop and execute response plans, including isolating affected systems, blocking malicious activities, and deploying necessary patches or countermeasures. Collaborate with technical teams to eradicate the root cause of incidents and implement remediation measures.
• Monitoring of security events in the SIEM, other security feeds and then take appropriate action based on the company security policy.
• Conduct forensic investigations to gather evidence and identify the source, extent, and impact of security incidents. Preserve and analyze relevant data, logs, and artifacts to support incident response efforts and potential legal or regulatory requirements.
• Create security plans, policies, protocols, and training to prepare the Ecobank group for efficient and effective incident response.
• Establish protocols for internal and external communication during and after security incidents.
• Prepare comprehensive incident reports documenting the details, actions taken, and lessons learned from security incidents. Communicate findings to relevant stakeholders, including management, IT teams, and external entities as required.
• Conduct root cause analysis of incidents to identify gaps and work with engineers to fix the identified gaps.
• Work with the SOC to define use/misuse cases for all systems integrated into the SIEM.
• Work with the SOC to build a comprehensive and updated asset Inventory for the group.
• Support Corporate Investigations and Group Audit with Forensic and Investigations as and when required.
• Continuously improve the incident response process by identifying gaps, developing, and implementing best practices, and leveraging automation and orchestration tools.
• Contribute to the development of incident response playbooks, standard operating procedures (SOPs), and incident handling guidelines.
• Close, hold, return or escalate the security incident based on the results of the response actions and the instructions in the playbook.

• 5 – 7 years practical and professional experience in Incident Response, Security Operations, Software Development, Applications Support, Systems administration and Network design and implementation.
• Bachelor's degree in computer science, Information Technology or a related discipline is desired.

• Advanced knowledge and skill in application of the concepts and practices in cybersecurity, computer programming, networking, computer operating systems (Windows, UNIX), malware forensics, threat analysis, cyber incident handling and response, penetration testing, software/malware reverse engineering.
• Knowledge of the application of Information Assurance, threat hunting technologies and techniques, analysis of computer systems, operating systems, network communication protocols, computer and network architectures and virtual machine technology to investigate a security incidence.
• Ability to analyze and correlate data to distinguish evidence of attacks or intrusions from normal activity.
• Ability to compile malware intelligence and research to present to business leaders and stakeholders.
• Proficiency in using security technologies and tools, including SIEM, IDS/IPS, EDR, and network analysis tools.
• Relevant certifications such as GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP), CompTIA Cybersecurity Analyst (CySA+) or Certified Ethical Hacker (CEH) are highly desirable.

JobDirecta