Senior Security Specialist

We’re looking for a Senior Security Specialist to join us in Reading

Reporting into our Senior CERT Manager you will help continue to mature the way in which the organisation manages and handles the operational security incidents of our ever evolving business. The person will provide a passion and deep technical understanding of how to investigate and handle cyber incidents. You and the team will support the entire portfolio of Liberty Global across our global network to detect, respond, remediate and recover from cyber‑attacks but also proactively defend against them through Intelligence Led Threat Hunting

The role will encompass being a Security Subject Matter Expert (SME), and will lead, guide, and inspire the team of security analysts with a view to develop these skills amongst the team whilst also acting as a technical escalation point. As such, the role requires a deep technical understanding of intrusion detection and analysis, incident response, vulnerability management, and infrastructure.

Driving forward the technical skill set of the team by developing threat hunting, adversary emulation, leading edge threat mitigation methodologies and security use cases.

Understand complex IT environments with broad range of knowledge around networking, system administration, database platforms and develop defensive methodologies around likely methods of attack.

Experience in analysing a wide range of log sources, data normalization and querying of data using analytical platforms ( e.g. Splunk, Hadoop, Elastic, Kibana, MDE and MCAS).

Identification of malware types, infection methods, provenance and objective of the malware. This will also require extraction of IoC’s and TTP’s.

To assist and develop investigations and respond to security incidents.

A self‑starter is required for this role and the successful applicant will be able to demonstrate taking ownership of and responsibility for resolving issues.

They will also be able to work as part of a wider team, guide a team, and be confident in making decisions.

The role will be predominantly Mon‑Fri office hours, although some out of hours support is envisaged.

• Demonstrated experience of managing, investigating and responding to cyber incidents.
• Deep knowledge and understanding of co‑ordinating cross‑organisational responses to security incidents.
• In depth knowledge of technical security systems, security architecture, security technology, and associated penetration testing and Security Event Management methodologies.
• In-depth knowledge of Splunk queries, dash boarding, Use case creation and Enterprise Security.
• In depth knowledge of Cyber Security Methodologies including the Cyber Kill Chain, Mitre ATT&CK Framework, NIST, MITRE Def3nd.
• Ability to identify developing patterns and trends in data and be able to provide incident root cause analysis, with a view to identifying and influencing future prevention by maintaining the Incident knowledge base.
• Experience of other security technologies & defences such as Firewalls, Snort, Bro, Intrusion Detection System (IDS) monitoring and custom rule creation (YARA), TCP / IP Networking, Wire Shark , TCPDump , Netflow analysis.
• In depth understanding of IT systems and technologies ( e.g. Linux and Windows operating systems, E‑Mail, Proxies, Endpoint Protection).
• Working knowledge of SIEM architecture, XDR and Vulnerability Management, Incident Response tooling such as Hive.
• Sandboxing technologies such as Cuckoo and Malware reverse engineering IE IDA Pro, ole debugger (both static and dynamic analysis required ), and a good understanding of REMnux.
• Understanding DFIR toolsets ( e.g. Volatility, SIFT Workstation) memory and file system analysis, and attack vectors.
• Knowledge of Data Protection (GDPR) and its role within a business. Technical & Management reporting to demonstrate effectiveness and value of the teams work.

• Global Information Assurance Certifications (GIAC) e.g. Certified Incident Handler (GCIH), Certified Intrusion Analyst (GCIA), Reverse Engineering Malware (GREM) would be an advantage.

• Competitive salary + Bonus
• 25 days…