Metropolitan Transportation Authority - New York, NY

posted 5 months ago

Full-time - Mid Level
New York, NY
Transit and Ground Passenger Transportation

About the position

The Specialist Cybersecurity SOC Analyst plays a crucial role in maintaining the security posture of the Metropolitan Transportation Authority's (MTA) Information Technology (IT) and Operational Technology (OT) infrastructure. This position is part of a 24/7 Security Operations Center (SOC) that continuously monitors cybersecurity alerts and events. The analyst is responsible for identifying suspicious activities, vulnerabilities, and potential threats across various attack vectors, escalating incidents, and recommending or deploying mitigation tactics. The primary objective is to safeguard the MTA's critical infrastructure and sensitive information from cyber threats posed by cybercriminals or malicious insiders. In this role, the analyst will utilize multiple data analytics tools, including Security Information and Event Management (SIEM), User and Entity Behavior Analytics (UEBA), and Artificial Intelligence (AI) technologies, to conduct thorough analyses. The analyst will collaborate with security engineers, architects, developers, vendors, and business units to enhance the overall security posture of the MTA. The position requires a focus on specific domains within cybersecurity, allowing the analyst to proactively and reactively detect, protect, and advise the organization on security matters. The responsibilities include conducting security monitoring and intrusion detection analysis using various technologies, providing incident response support, performing threat hunting across diverse environments, and identifying tactics, techniques, and procedures (TTPs) of potential threats. The analyst will also document formal incident reports, validate incident response plans, and compile data for management reporting. This role may require working outside of normal hours to support the 24/7 operations and may involve travel to other MTA locations or external sites.

Responsibilities

  • Conduct security monitoring and intrusion detection analysis using various technology and analytic tools.
  • Provide incident response support, including mitigating actions to contain activity and facilitating forensics analysis when necessary.
  • Perform threat hunting searches across a variety of technologies that are on-prem, cloud-based, and hybrid.
  • Identify the tactics, techniques, and procedures (TTPs) of potential threats through the MITRE ATT&CK or similar frameworks.
  • Provide advanced analytical capability in several security domains.
  • Add new components to a roadmap, document them effectively, and direct the testing and implementation of changes.
  • Develop and implement action plans to improve security in their security domain(s) and related technology.
  • Analyze security and performance data to assess the efficacy of installed technologies.
  • Provide ongoing support and troubleshooting for incidents, correlations, and reporting to junior analysts.
  • Correlate events and activities across systems to identify trends of unauthorized use.
  • Review alerts and data from sensors and document formal, technical incident reports.
  • Respond to computer security incidents according to the incident response policy and procedures.
  • Provide technical guidance to first responders for handling information security incidents.
  • Compile and analyze data for management reporting and metrics.
  • Monitor threat intelligence feeds to identify a range of threats, including indicators of compromise and advanced persistent threats (APTs).
  • May mentor less experienced staff.

Requirements

  • Bachelor's degree in a relevant field.
  • At least 3 years of relevant experience in cybersecurity or a related area.
  • Expert/highly proficient understanding of technology and cybersecurity domain principles within Operational Technologies, Signaling Systems, and Rolling Stock.
  • Expert/highly proficient in the intelligence lifecycle including Direction, Collection, Processing, Analysis, Dissemination, and Feedback.
  • Expert/highly proficient in developing countermeasures for systems including SIEM, Endpoint Security, Network Defenses, WAF, etc.
  • Expert/highly proficient in system integrations and automation pertaining to intelligence requirements.
  • Strong technical knowledge and diverse skillset to understand various technologies, systems, and potential risks.

Nice-to-haves

  • At least one certification in the current platform/domain/technical skills.

Benefits

  • Eligible for telework (currently two days per week).
  • Competitive salary range of $110,748 - $130,719 per year.
© 2024 Teal Labs, Inc
Privacy PolicyTerms of Service