Consultant - Cyber Security Operations

Organizational Context

The Division of Information Technology supports the IAEA with ICT, managing systems, strategy, standards, and central services. It operates a robust infrastructure including hardware, software, and cloud services, adhering to ITIL and Prince2 best practices. The Infrastructure Services Section, within which this role sits, is responsible for IT security services and data centre management, serving over 2500 staff and 10000 external users globally.

Job Purpose

This consultancy role within the Security Systems Unit focuses on providing critical support and expertise in cyber security operations and incident response. The consultant will be responsible for conducting in-depth analysis of data and alerts from security monitoring tools. This involves independent work and close collaboration with internal and external service providers. The consultant will leverage their technical expertise to enhance existing systems and operations, contributing to the overall security posture of the IAEA. The role is integral to maintaining the integrity and security of the IAEA's information technology infrastructure.

Responsibilities

The consultant will perform key functions including collecting and analyzing evidence such as network traffic, volatile data, and logs to identify security threats and indicators of compromise. They will conduct real-time analysis and correlation of events from diverse data sources to detect anomalies and potential security incidents. The role involves providing technical resolution or escalation for security investigation tickets, ensuring proper containment, eradication, and recovery processes. Additionally, the consultant will conduct threat hunting exercises based on intelligence and research, suggest improvements for security detection and monitoring capabilities, and recommend tuning for signatures and rules. They will also update relevant documentation and SOPs, and provide ongoing reports to senior management.

Work Experience

A minimum of 5 years of relevant professional experience is required. This includes at least 2 years of experience in operational security monitoring, incident response, technical threat intelligence, or security research. Demonstrated experience in security analysis, incident response, and/or digital forensics using various data sources and technologies is essential.

Skills

Demonstrated experience in security analysis, incident response, and digital forensics. Proficiency with intrusion detection, SIEM, EDR, and other security tools. Strong problem-solving and technical issue diagnosis skills. Excellent verbal and written communication. Technical understanding of network fundamentals and protocols. Experience with programming or scripting languages is desirable. Excellent knowledge of English.

Explore related opportunities