Cyber Security Operations Center Leader - REMOTE
Job Information
CSAA Insurance Group (CSAA IG), a AAA insurer, is one of the top personal lines property and casualty insurance groups in the U.
S. Our employees proudly live our core beliefs and fulfill our enduring purpose to help members prevent, prepare for and recover from life's uncertainties, and we're proud of the culture we create together.
As we commit to progress over perfection, we recognize that every day is an opportunity to be innovative and adaptable. At CSAA IG, we hire good people for a brighter tomorrow.
We are actively hiring for a Cyber Security Operations Center Leader - Remote! Join us and support CSAA IG in achieving our goals.
Your Role : We are looking for a Cyber Security Operations Center (CSOC) Leader to join our team. The CSOC Leader will oversee all day-to-day cybersecurity operations matters supporting CSAA’s defense against potential threats, from team leadership to technical investigations.
The CSOC Leader will help guide and mature the CSOC team and program, implementing a framework for continuous validation and improvement for the team.
Your work :
Oversee and lead a talented and maturing team conducting cyber security operations, monitoring, investigation, and analysis.
Develop procedures to realize process maturity, including process documentation and runbook evaluation, quality assurance review, skill evaluation, training, and development, project tracking to implement maturity measures, and metrics to report on program effectiveness.
Provide subject matter expertise on cyber security investigations and platforms, including SIEM, SOAR, EDR and other security technologies.
Develop and lead advanced CSOC capabilities, including threat hunting, threat intelligence, digital forensics, incident response, purple team testing, and malware analysis.
This includes selection and implementation of technology and training to support these functions.
Serve as incident commander during major incidents, providing communications and oversight for the CSOC response team and senior leadership, including periodic on-call rotation.
Oversee production of all relevant reporting including incident reports, after action reviews, and
Oversee a detection engineering process and lifecycle to evaluate new detections, produce new detection rules, develop acceptance testing criteria and efficacy goals, develop ongoing evaluation and fidelity reviews, create testing regimens to validate detection parameters, and create a feedback mechanism between CSOC analysts and detection engineers.
Develop, advertise, expand, and maintain the CSOC service catalog to meet the security operations needs of the organization.
Mentor and coach junior staff to develop more comprehensive skills and knowledge transfer in CSOC.
Support the full talent recruitment and retention cycle including working with HR to develop job descriptions, interviewing, and selecting candidates, working with HR to develop compensation goals, new hire onboarding and training, performance management, and individual training and development goal creation and monitoring.
Oversee shift scheduling and on-call to ensure 24x7 CSOC staffing and coverage.
Risk identification and reporting to senior leadership.
Cross functional collaboration with other security team members.
Broad subject matter expertise to evaluate new and existing technologies and solutions to make recommendations to the business to address and remediate identified risks and threats to the organization.
What would make us excited about you?
Strong technical experience and familiarity with various techniques of cyber-attacks, MITRE Att&ck framework.
Experience supporting incident response and / or investigations.
Possess knowledge of Intelligence Community (IC) fundamentals (classifications, Traffic Light Protocol (TLP), Intelligence Sharing and Analysis Centers (ISACs).
Ability to communicate complex ideas and concepts effectively, using the correct grammar and terminology, both orally and in writing, with senior management staff, information systems professionals, and technical and non-technical users.
Ability to quickly and effectively digest disparate data sources to determine security implications and risk levels.
Able to provide recommendations of security improvements by assessing current efficacy of current capabilities / solutions, evaluating trends and anticipating requirements.
Possess knowledge of virtual environments, Cloud platforms (IaaS), network operating systems, mobile device environments, and data encryption methods.
Demonstrated expertise in network communication protocols, operating systems, servers, firewall implementation, IPS / IDS systems, and advanced malware detection systems.
Must be able to multi-task and work independently on moderate to complex assignments using independent professional discretion and judgment as well as transition quickly between projects with minimal supervision.
Ability to maintain effective working relationships with colleagues, users, contractors, and vendors.
Possesses the ability to use in-depth knowledge to identify and present practical intelligence to team members and senior leadership.
Maintain advanced knowledge of tools and techniques for analysis and identification of the nature of threats.
Ability to perform security analysis of network traffic data and report on threats as needed, and act as the escalation point for additional analysis.
Solid understanding of networking protocols and infrastructure designs; including routing, firewall functionality, host and network intrusion detection systems, encryption, load balancing, and other network protocols.
Experience with log analysis, traffic flow analysis and experience with associated infrastructure and systems to aid in the identification of malware or other malicious behavior.
Experience using a broad array of security tools including Security Information and Event Management (SIEM) system, intrusion detection systems, web proxy systems, routers, switches, firewall deployment and other tools used to assess network security.
Demonstrated knowledge of techniques used to analyze network traffic for malicious activity and perform packet analysis.
Identify, extract, and leverage intelligence from intrusion attempts carried out by advanced cybercriminals or advanced persistent threat (APT) groups.
Piece together and track intrusion campaigns and activity carried out by various threat actors, and nation-state / advanced threat actor activity.
Fully analyze network and host activity in successful and unsuccessful intrusions by advanced attackers.
Demonstrated ability to work in a team environment both in-person and remotely, with minimal supervision.
Possess strong time management skills and the ability to effectively prioritize tasks and work independently with minimal daily management interaction.
Excellent written and verbal communication skills, analytical ability, strong judgment and leadership skills, and the ability to work effectively with peers, IT management, and senior leaders.
Ability to participate in meetings and projects with customers and partners, including those involving technical topics or technical service delivery.
Strong problem-solving skills, and a desire to attempt to work through blockers prior to seeking assistance.
Experience with a variety of technologies & ability to develop queries to support and manage the security environment, e.
g. Splunk, ServiceNow, Microsoft, Python, Cloud, SPL search processing language, etc.
MSSP Engagement experience.
BS degree in Computer Science, MIS, Computer Engineering, or 15+ years equivalent technology experience.
10+ years direct security operations experience.
10+ years of experience with tracking APT groups and other high-grade threats.
10+ years of experience in system, network, and / or application security.
10+ years of experience building automation.
10+ years of experience with SQL or other query languages.
GCIH or other relevant certifications.
Shows respect for differences through excellent communication skills with people from an array of backgrounds.
Creates a collaborative, inclusive and psychologically safe environment, demonstrating authenticity and fostering trust to inspire and empower team members and colleagues.
Actively shapes our company culture through words and actions (e.g., supporting employee resource groups, mentoring employees, volunteering, joining cross-functional projects, encouraging team member involvement in these activities)
Champions our cultural norms (e.g., willing to have cameras when it matters : interviewing candidates, building relationships with team members, etc.)
Translates our enterprise strategy and priorities for their team members to connect to the bigger picture.
Demonstrates a company ownership mindset, thinking beyond boundaries of their own area.
Travels as needed for role, including enterprise meetings, divisional / team meetings, and other in-person meetings.
Fulfills business needs, which may include investing extra time, helping other teams, etc.
CSAA IG Careers
At CSAA IG, we’re proudly devoted to protecting our customers, our employees, our communities, and the world at large. We are on a climate journey to continue to do better for our people, our business, and our planet.
Taking bold action and leading by example. We are citizens for a changing world, and we continually change to meet it.
Join us if you
BELIEVE in a mission focused on building a community of service, rooted in inclusion and belonging.
COMMIT to being there for our customers and employees.
CREATE a sense of purpose that serves the greater good through innovation.
Recognition : We offer a total compensation package, performance bonus, 401(k) with a company match, and so much more!
Related Jobs
Cyber Security Operations Center Leader - REMOTE
Security Officer
AI Research Intern - Privacy & Security
Digital Solutions | Wireless Security Product Architect