Level 3 Cybersecurity Analyst (SOC)

Company Description

Wepoint is the architect of major transformations for businesses and public sector organizations.

We support our clients from strategy through technological implementation, always striving to think beyond the obvious and to act within the framework of Economic, Social, Environmental, and Technological Responsibility (RESET). Our goal is to create new ways of working, new economic models, and smarter environments.

In nearly 20 years, we have become one of the key players in digital transformation, employing 3,500 people across Europe, Tunisia, North America, and the Asia-Pacific region.

What We Are Looking For

COURAGE – AUTHENTICITY – OPENNESS – COMMITMENT – ELEGANCE

Do these words resonate with you? They are our company values.

At Wepoint, we are looking for committed talents who are ready to share their expertise within open and collaborative teams, and who are not afraid to take initiative. We also value people who are able to challenge themselves and continuously improve.

At the heart of relationships at Wepoint are authenticity and the constant pursuit of excellence for our clients - this is what we expect from our future colleagues.

Job Description

The Level III Cybersecurity Analyst position is responsible for providing security expertise to the 24/7 Security Operations Center (SOC). The primary objective of this position is to contribute to the coordination and monitoring of cyber incidents affecting the bank’s critical assets by detecting, preventing, and responding to cyber threats targeting the group’s infrastructure. This role provides essential support to the organization’s overall cybersecurity program through close collaboration with the various lines of business across the region, as well as with external clients, partners, and regulatory authorities. As a Production Security Analyst, you will be responsible not only for the real-time monitoring, analysis, and resolution of identified security incidents, but also for the continuous improvement and development of the 24/7 Security Operations Center (SOC) capabilities, which serve as the first line of defense in identifying potential information security incidents.

Responsibilities

• Analyze security log data from a wide range of heterogeneous security devices and identify trends;
• Be responsible for the development and validation of use cases;
• Provide Incident Response (IR) support or escalate when analysis confirms that an incident requires action;
• Perform threat and vulnerability analysis and provide security advisory services;
• Develop the Threat Hunting program and capabilities;
• Analyze and respond to previously undisclosed software and hardware vulnerabilities;
• Investigate, document, and report on information security issues and emerging trends;
• Perform Threat Hunting activities to identify potential malicious actors within the network;
• Perform digital forensic investigations on compromised systems to determine the extent and nature of the compromise and provide recommendations regarding appropriate remediation measures;
• Provide support and conduct research regarding any security-related questions or incidents;
• Perform tasks independently with some level of oversight;
• Integrate and share information with other analysts and teams;
• Monitor the bank’s various sources for potential security incidents, health alerts related to monitored solutions, and requests for information. This includes monitoring real-time channels or dashboards, periodic reports, email inboxes, help desks or other ticketing systems, telephone calls, and chat sessions;
• Follow incident-specific procedures to triage potential security incidents, validate them, determine the necessary mitigation measures, and keep these procedures up to date;
• Escalate potential security incidents to Level IV engineers, implement countermeasures in response to requests, and recommend operational improvements;
• Accurately document incident information and notes in the case management system;
• Maintain up-to-date knowledge of the bank’s technology architecture, known vulnerabilities, the architecture of the security solutions used for monitoring, imminent and widespread threats identified through client threat intelligence, and recent security incidents;
• Continuously improve the service by identifying and addressing issues or knowledge gaps, including analysis procedures, response playbooks, and client network models; tuning false positives; and identifying and recommending new or updated tools, content, countermeasures, or scripts;
• Serve as a subject matter expert in at least one security-related area, such as a specific anti-malware solution, Python programming, etc.;
• Actively seek to develop skills through continuous learning and pursue advancement to a Level IV Analyst position;
• Comply with internal operational security policies as well as other BNP Paribas policies;
• Perform limited-scope project work as required.

Qualifications

• Connaissance ou 3 à 5 ans d’expérience avec les technologies suivantes : SIEM, ELK, IDS/IPS, pare-feu réseau et hôte, solutions de prévention des fuites de données (DLP);
• Expérience pratique avec les logiciels antivirus, les solutions de détection et de réponse sur les terminaux (EDR), les pare-feu et les solutions de filtrage de contenu;
• Expérience ou connaissances démontrables en réponse aux incidents, analyse de journaux ("logs") et analyse de captures réseau (PCAP);
• Bonne connaissance des principes fondamentaux des réseaux, notamment : modèle OSI, TCP/IP, DNS, HTTP(S) et SMTP;
• Bonne compréhension des méthodes utilisées par les acteurs malveillants pour attaquer un réseau, notamment l’hameçonnage ("phishing"), le balayage de ports ("port scanning"), les attaques contre les applications Web, les attaques DDoS et les mouvements latéraux;
• Connaissance des systèmes d’exploitation Windows et/ou Linux, ainsi que des méthodes permettant de les analyser afin d’identifier des signes de compromission;
• Réel intérêt pour l’apprentissage et volonté de contribuer au développement continu de l’équipe;
• Connaissances de base en langages de script ("scripting").
• Capacité à démontrer une méthodologie rigoureuse dans l’investigation des alertes et/ou des indicateurs de compromission, et à documenter les conclusions de manière à ce qu’elles soient compréhensibles aussi bien par les collègues techniques que par les membres de la haute direction;
• Bonne compréhension des rôles complémentaires des différentes équipes de cybersécurité et capacité à collaborer avec celles-ci, notamment les équipes de forensique numérique, renseignement sur les menaces ("Threat Intelligence"), tests d’intrusion ("Penetration Testing"), gestion des vulnérabilités, etc.;
• Capacité à gérer des charges de travail variables, des priorités concurrentes et plusieurs activités simultanément;
• Excellentes capacités d’analyse;
• Excellente communication en français et en anglais. L'anglais est requis, le poste demandant de communiquer avec des clients et des partenaires situés à l'extérieur du Québec.

Seuls les candidat(es) légalement autorisés(ées) à travailler pour tout employeur au Canada seront considérés(ées)

Wepoint Benefits

• Minimum of 3 weeks of vacation starting from the first year;
• Comprehensive group insurance with a generous employer contribution;
• Employer contribution to a group RRSP;
• Full remote work flexibility: Hybrid, Remote, or On-site;
• A warm, bright, and welcoming office offering fresh fruit, coffee, beverages, occasional meals, etc.;
• Annual IT equipment budget;
• A balanced work environment with flexible working hours;
• Career development: training and certifications, online or in-person learning, Wepoint Academy, etc.;
• An international community of experts ready to share their knowledge;
• A company culture focused on individuals’ needs and their belonging to a strong community.

#tech&security

Permis CNESST : AP-2504754, AP-2504755, AR-2504756