APS - Security Log analysis specialist

We are seeking an experienced Security Engineer with proved competence in Cloud & Cybersecurity Knowledge and skill.

The candidate have to monitor and manage Log Management activities to ensure detection and effective investigation & response in case of security issues.

The candidate will have proven technical skills on Linux and Windows O.S., as well as knowledge in Cloud infrastructure & Cybersecurity workflow, essential to carry out the required activities.

He will manage the specific technologies to ensure:

the correct update and security posture of local Antivirus, with reference to viral signature and client to server connectivity

the correct update and data transfer of security logs from servers and network assets to local and central Log Collection infrastructure.

Responsibilities

• Daily monitoring of log connectivity process and infrastructure, checking the correct sending of logs and reacting in case of malfunctions.
• Maintain the Log Management infrastructure, updating the application and/or its components (agents) when necessary following ITGP roadmap.
• Manage the local Antivirus console, checking the correct functioning and ensuring that all client/server download policies and updates correctly. The local infrastructure will be under direct control of the team and any incident or update will be carryout based on Vendor release.
• Capability to manage change and incident in scope perimeters.
• Ensure that SLA targets are met for above activities.

• Contribute to the knowledge transfer with BNL Production Security team
• Contribute to the definition of procedures and processes necessary for the team
• Help build team spirit and integrate into BNL BNP Paribas culture
• Contribute to incidents analysis and associated problem management
• Contribute to the regular activity reporting and KPI calculation
• Contribute to continuous improvement actions
• Contribute to the acquisition by ISPL team of new skills & knowledge to expand its scope

• Expertise in cybersecurity frameworks and practices (ISO27001, DORA, NIST, NIS2)
• Strong knowledge of CVE management and experience with vulnerability mitigation
• Solid understanding of cloud security (GCP and/or AWS)
• Knowledge of container security (Docker, Anchore)
• Proven expertise in major OS (Linux, Windows, AIX).
• Knowledge of major middleware (WAS, JRE, Oracle and SQL).
• Strong knowledge of Symantec Endpoint Protection Antivirus.
• Knowledge Elastic Search, EDR, Kafka tools.

Experience of using the Microsoft Office Suite and dashboarding tools:

o Macro, VBScript, Excel formulas, PowerPoint presentation.

• Experience with ServiceNow ticketing system

Proven experience in Incident investigation and root-cause analysis.

Fluent in English (both written and spoken)

• Excellent communication-skills to work constructive and in cooperation with internal and external teams
• Analytical and problem-solving skills
• Good degree of responsibility and autonomy

Fluent English (both written and spoken).

Basic knowledge of Italian language can be an advantage.

Knowledge of following tools/software will represent a preferential title:

• Tanium EDR agent
• Logstash agent
• Power BI
• Ansible Tower
• Servicenow