Incident Response Engineer

As a valued member of the ETMSA team at Crypto.com, you will play a crucial role in addressing and mitigating cybersecurity threats and incidents at all stages of their lifecycle. This includes Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned, collaborating closely with a global team of incident responders.

Your primary focus will be using your extensive expertise in cyber defense, digital forensics, log analysis, and intrusion analysis to handle security incidents across endpoints, network, and cloud infrastructure. You will be responsible for a range of activities including prevention, detection, response, and remediation, utilizing technologies such as Next-Generation Firewalls (NGFW), Endpoint Detection and Response (EDR), Intrusion Detection/Prevention Systems (IDS/IPS), and Data Loss Prevention (DLP).

In addition, your strong communication and collaboration skills will be essential as you work effectively with various stakeholders in diverse and global environments.

Responsibilities

• Reporting directly to the Director to oversee all phases of the incident response lifecycle.
• Engaging in different incident prevention projects aimed at enhancing security posture.

Preparation:

• Understanding various regulatory and compliance requirements and participating in self-assessment exercises to ensure smooth incident response processes.
• Developing incident response runbooks, playbooks, and SOPs in alignment with regulatory mandates.
• Assessing the readiness of incident response across different layers - people, processes, and technologies.

Detection & Analysis:

• Handling cybersecurity incidents escalated from various sources including the 24/7 SOC team.
• Responding to incidents in compliance with local authority and regulatory requirements.
• Assessing the risk, impact, and scope of identified security threats and conducting in-depth incident analysis of diverse data sources.

Containment, Eradication, and Recovery:

• Collaborating with stakeholders to provide guidance on containing and eradicating security incidents.
• Participating in root cause analysis using forensic tools to identify sources of compromise and malicious activities.
• Documenting and presenting investigative findings for notable events and incidents.

Post-Incident Activities:

• Conducting lessons learned sessions for stakeholders, leading follow-up activities, documenting incidents in the case management system, and preparing incident reports.
• Remaining prepared to promptly assist in the event of security incidents.

Requirements

• Minimum of 5 years of experience in the Cyber Security industry.
• Strong technical and analytical skills with hands-on experience in incident response activities.
• Proficiency in scripting languages such as Bash, PowerShell, Python, etc., for incident response in various operating systems and cloud environments.
• Familiarity with cybersecurity tools and software like NGFW, EDR, IDS/IPS, SIEM, among others.
• Knowledge of frameworks like MITRE ATT&CK and Cyber Kill Chain, as well as an interest in exploring new technologies and enhancing team capabilities.
• Security certifications such as Azure, AWS, CISSP, GCIH, GCIA, GCFA, GNFA, GREM, or similar are advantageous.
• Awareness of regulatory and compliance requirements like GDPR, MAS, PSD2 is a plus.

Preferably

• Rapid learner with a proactive attitude and willingness to engage hands-on.
• Strong team player with a collaborative mindset and a passion for continuous learning.
• Veer leadership qualities with a focus on ownership, accountability, urgency, and prioritization.
• Comfortable in managing incidents and engaging technical stakeholders with sound business acumen during decision-making processes.