Level 3 Cybersecurity Analyst

Company Description Wepoint is the architect of major transformations for businesses and public sector organizations. We support our clients from strategy through technological implementation, always striving to think beyond the obvious and to act within the framework of Economic, Social, Environmental, and Technological Responsibility (RESET). Our goal is to create new ways of working, new economic models, and smarter environments. In nearly 20 years, we have become one of the key players in digital transformation, employing 3,500 people across Europe, Tunisia, North America, and the Asia-Pacific region.What We Are Looking For COURAGE – AUTHENTICITY – OPENNESS – COMMITMENT – ELEGANCE Do these words resonate with you? They are our company values. At Wepoint, we are looking for committed talents who are ready to share their expertise within open and collaborative teams, and who are not afraid to take initiative. We also value people who are able to challenge themselves and continuously improve. At the heart of relationships at Wepoint are authenticity and the constant pursuit of excellence for our clients — this is what we expect from our future colleagues.Job Description
The Level III Cybersecurity Analyst position is responsible for providing security expertise to the 24/7 Security Operations Center (SOC). The primary objective of this position is to contribute to the coordination and monitoring of cyber incidents affecting the bank’s critical assets by detecting, preventing, and responding to cyber threats targeting the group’s infrastructure. This role provides essential support to the organization’s overall cybersecurity program through close collaboration with the various lines of business across the region, as well as with external clients, partners, and regulatory authorities. As a Production Security Analyst, you will be responsible not only for the real-time monitoring, analysis, and resolution of identified security incidents, but also for the continuous improvement and development of the 24/7 Security Operations Center (SOC) capabilities, which serve as the first line of defense in identifying potential information security incidents.Responsibilities
Analyze security log data from a wide range of heterogeneous security devices and identify trendsBe responsible for the development and validation of use casesProvide Incident Response (IR) support or elevate when analysis confirms that an incident requires actionPerform threat and vulnerability analysis and provide security advisory servicesDevelop the Threat Hunting program and capabilitiesAnalyze and respond to previously undisclosed software and hardware vulnerabilitiesInvestigate, document, and report on information security issues and emerging trendsPerform Threat Hunting activities to identify potential malicious actors within the networkPerform digital forensic investigations on compromised systems to determine the extent and nature of the compromise and provide recommendations regarding appropriate remediation measuresProvide support and conduct research regarding any security-related questions or incidentsPerform tasks independently with some level of oversightIntegrate and share information with other analysts and teamsMonitor the bank’s various sources for potential security incidents, health alerts related to monitored solutions, and requests for information. This includes monitoring real-time channels or dashboards, periodic reports, email inboxes, help desks or other ticketing systems, telephone calls, and chat sessionsFollow incident-specific procedures to triage potential security incidents, validate them, determine the necessary mitigation measures, and keep these procedures up to dateEscalate potential security incidents to Level IV engineers, implement countermeasures in response to requests, and recommend operational improvementsAccurately document incident information and notes in the case management systemMaintain up-to-date knowledge of the bank’s technology architecture, known vulnerabilities, the architecture of the security solutions used for monitoring, imminent and widespread threats identified through client threat intelligence, and recent security incidentsContinuously improve the service by identifying and addressing issues or knowledge gaps, including analysis procedures, response playbooks, and client network models;
tuning false positives;
and identifying and recommending new or updated tools, content, countermeasures, or scriptsServe as a subject matter expert in at least one security-related area, such as a specific anti-malware solution, Python programming, etc.Actively seek to develop skills through continuous learning and pursue advancement to a Level IV Analyst positionComply with internal operational security policies as well as other BNP Paribas policiesPerform limited-scope project work as requiredQualifications
Connaissance ou 3 à 5 ans d’expérience avec les technologies suivantes : SIEM, ELK, IDS/IPS, pare-feu réseau et hôte, solutions de prévention des fuites de données (DLP)Expérience pratique avec les logiciels antivirus, les solutions de détection et de réponse sur les terminaux (EDR), les pare-feu et les solutions de filtrage de contenuExpérience ou connaissances démontrables en réponse aux incidents, analyse de journaux ("logs") et analyse de captures réseau (PCAP)Bonne connaissance des principes fondamentaux des réseaux, notamment : modèle OSI, TCP/IP, DNS, et SMTPBonne compréhension des méthodes utilisées par les acteurs malveillants pour attaquer un réseau, notamment l’hameçonnage ("phishing"), le balayage de ports ("port scanning"), les attaques contre les applications Web, les attaques DDoS et les mouvements latérauxConnaissance des systèmes d’exploitation Windows et/ou Linux, ainsi que des méthodes permettant de les analyser afin d’identifier des signes de compromissionRéel intérêt pour l’apprentissage et volonté de contribuer au développement continu de l’équipeConnaissances de base en langages de script ("scripting")Capacité à démontrer une méthodologie rigoureuse dans l’investigation des alertes et/ou des indicateurs de compromission, et à documenter les conclusions de manière à ce qu’elles soient compréhensibles aussi bien par les collègues techniques que par les membres de la haute directionBonne compréhension des rôles complémentaires des différentes équipes de cybersécurité et capacité à collaborer avec celles-ci, notamment les équipes de forensique numérique, renseignement sur les menaces ("Threat Intelligence"), tests d’intrusion ("Penetration Testing"), gestion des vulnérabilités, etc.Capacité à gérer des charges de travail variables, des priorités concurrentes et plusieurs activités simultanémentExcellentes capacités d’analyseExcellente communication en français et en anglais. L'anglais est requis, le poste demandant de communiquer avec des clients et des partenaires situés à l'extérieur du Québec. Seuls les candidat(es) légalement autorisés(ées) à travailler pour tout employeur au Canada seront considérés(ées)Wepoint Benefits
Minimum of 3 weeks of vacation starting from the first yearComprehensive group insurance with a generous employer contributionEmployer contribution to a group RRSPFull remote work flexibility: Hybrid, Remote, or On-siteA warm, bright, and welcoming office offering fresh fruit, coffee, beverages, occasional meals, etc.Annual IT equipment budgetA balanced work environment with flexible working hoursCareer development: training and certifications, online or in-person learning, Wepoint Academy, etc.An international community of experts ready to share their knowledgeA company culture focused on individuals’ needs and their belonging to a strong community#tech&security Permis CNESST : AP-2504754, AP-2504755, AR-2504756 As an architect of major transformations for companies and public sector players, Wepoint is building a direction and outlining future prospects in an uncertain world, by putting technological innovation at the service of its customers' and society's progress.
#J-18808-Ljbffr