POSITION SUMMARY:

The Incident Responder/Threat - Cyber Security Sr. Manager (IR/TH) is an experienced position within the CSIRT and will play a pivotal role in identifying, analysing, and mitigating potential cybersecurity threats. The ideal candidate will have a strong background in threat hunting, cyber threat intelligence, and incident response, along with a deep understanding of various attack vectors and techniques. You will work to proactively identify emerging threats, conduct in-depth investigations, and contribute to enhancing our organization's overall security posture. You interact closely with BCG’s SIEM and MSSP to enhance detection capabilities and understand the current threats against BCG’s network and provides Tier 3 incident response support. These tasks ensure that all cyber security incidents are accessed and communicated to relevant stakeholders in a timely manner. You will work with various teams inside BCG (Information Management Team, Global Functions and IT) and with vendors, suppliers, and partners to support the SOC’s mission of preventing, detecting, and responding to cyber threats.

This Incident Response / Threat Hunting role is an integral part of our CSIRT team and will require the incumbent to play a proactive role in identifying and mitigating emerging cyber threats. In addition, the role will involve providing expert guidance and advice to analysts during security incidents, enhancing the team's incident response capabilities and contributing to the overall cybersecurity posture of the organization.

This includes, but is not limited to:

• Conduct proactive threat hunting exercises to identify advanced and persistent threats within the organization's network and systems.
• Collaborate with cross-functional teams to develop and refine threat hunting methodologies, leveraging both internal and external threat intelligence sources.
• Analyze threat data from various sources, including logs, network traffic, and endpoints, to identify indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) associated with cyber threats.
• Investigate and respond to security incidents, analyzing the scope and impact of breaches, and developing mitigation strategies.
• Provide expertise in analyzing malware and malicious artifacts to understand their functionality and potential impact.
• Create and maintain detailed documentation of threat hunting processes, findings, and incident response procedures.
• Produce timely and accurate reports on threat hunting activities, findings, and recommended actions to stakeholders and management.
• Contribute to the development of playbooks, standard operating procedures, and other documentation to enhance the incident response process.
• Strong understanding of common cyber-attack techniques, such as phishing, malware propagation, lateral movement, and data exfiltration.
• Collaborate with the incident response team to develop and enhance incident response playbooks, ensuring alignment with threat intelligence insights.

YOU'RE GOOD AT

Under the general direction of the Information Security Manager or delegate and working with other IT, BST, etc. throughout the firm, the roles will perform the following functions:

Participate as an integral part of the CSIRT Team, Risk and IT in general.

• Work closely with CSIRT team people & technology to detect, assess, and communicate cyber threats.
• Proactively monitoring and analyze logs via the SIEM for indicators of attack.
• Lead proactive threat hunting initiatives, utilizing both internal and external threat intelligence sources, to identify potential threats and vulnerabilities.
• Develop and refine threat hunting methodologies, leveraging indicators of compromise (IOCs), tactics, techniques, and procedures (TTPs), and threat actor profiles.
• Collaborate closely with cross-functional teams to provide timely and relevant cyber threat intelligence updates, contributing to strategic security decisions.
• Perform in-depth analysis of threat data from various sources to identify patterns, correlations, and trends, and translate findings into actionable intelligence.
• Create and disseminate timely threat intelligence reports and alerts to stakeholders, enabling informed responses to emerging threats.
• Define SIEM use cases to collect, monitor and analyze data to discover and discern trends, threats, and security risks associated with BCG assets and information.
• Incorporating emerging threat intelligence and zero-day vulnerabilities into new detection content, as well as evaluating detection value and exposure throughout the entire detection lifecycle, including retirement and deprecation.

Maintain up-to-date knowledge of the cyber security industry as it relates to BCG including:

• Threat Hunting Frameworks & Methodologies
• Attacker methods and TTPs
• Standards, regulations, and legislation
• Technologies and solutions
• Industry best practices
• Threats and vulnerabilities

Provide input and represent BCG and client interests in the areas of:

• Threat Hunting, Incident response and investigation
• Incident response management for client security incidents
• Work with IT Directors, Managers, Architects and staff to implement, monitor and maintain Confidentiality, Availability and Integrity of BCG information assets.
• Track and manage materials provided to external providers and clients.
• Maintain information security credentials and certifications as required to present a credible presence to internal and external audiences.

YOU BRING (EXPERIENCE & QUALIFICATIONS)

• Bachelor’s degree (or equivalent) in Computer Science, Cybersecurity, Information Security, or a related field.
• Minimum 10 years of information security experience, with a very strong technical background.
• Demonstrated Threat Hunting, Threat Intelligence and Incident Response experience.
• Strong experience with threat hunting methodologies and tools, including but not limited to SIEM platforms, EDR solutions, network traffic analysis tools, and threat intelligence feeds.
• Proficiency in analysing and interpreting security logs, network traffic, and endpoint data to identify and investigate potential security incidents.
• Ability to craft advanced SPL to fulfil detection criteria, with a background in fine-tuning and testing use cases, adjusting SPL logic accordingly for optimal performance will be a great value add.
• Strong analytical, problem-solving, and critical-thinking skills, with the ability to work effectively in high-pressure situations.
• Experience with threat intelligence frameworks and methodologies, including STIX/TAXII, MITRE ATT&CK framework, and other relevant standards.
• Expertise in analyzing malware and malicious artifacts, employing both static and dynamic analysis techniques.
• Security certification like GIAC Cyber Threat Intelligence (GCTI), GIAC Certified Intrusion Analyst (GCIA) or GIAC Certified Incident Handler (GCIH) or equivalent a plus.

YOU'LL WORK WITH

BCG’s information technology group collaboratively delivers the latest digital technologies that enable our consultants to lead and our business to grow. For our IT jobs, we seek individuals with expertise in the areas of IT infrastructure, application development, business systems, collaborative and social technologies, information security, and project leadership.
 

ADDITIONAL INFORMATION

KEY COMPETENCIES:

Technical and functional expertise

• Requires an advanced level of professional knowledge in information technology and security developed through a combination of advanced degrees in information technology and hands on experience.
• Must have previous career development experience which has provided management skills, motivational skills, interpersonal skills, and outstanding organizational effectiveness.
• Knowledge of the legal and regulatory landscape related to security and privacy in an international environment.
• Very strong business sense with ability to relate technology issues to business.
• Requires strong analytical skills and abilities including an extensive knowledge of software, database, operating systems, client server architecture and voice and data communication services and facilities, security and privacy, in an international setting.
• Perform in-depth analysis of threat data from various sources to identify patterns, correlations, and trends, and translate findings into actionable intelligence.
• Communication, interpersonal and teaming skills
• Outstanding verbal and written communications skills are a must because of the requirement to represent BCG in communications with clients.
• Calm demeanour, grace under fire, outstanding listening skills

Leadership, impact, and change

• High level of initiative and self-motivation, resourceful, and patient with an iterative process
• Ability to gain trust and commitment of others at different levels of the organization.
• Proven ability to challenge traditional way of operating and moving beyond the obvious
• Translates BCG’s broader strategic objectives and cascades these into own work plans, metrics and teamwork plans.
• Works effectively with significant ambiguity and fluctuating priorities and constrains.