Threat Detection and Response Analyst

Do you want your voice heard and your actions to count Discover your opportunity with Mitsubishi UFJ Financial Group (MUFG), one of the worlds leading financial groups. Across the globe we have 150,000 colleagues, striving to make a difference for every client, organization, and community we serve. We stand for our values, building longterm relationships, serving society, and fostering shared and sustainable growth for a better world. With a vision to be the worlds most trusted financial group, it is part of our culture to put people first, listen to new and diverse ideas, and collaborate toward greater innovation, speed and agility. This means investing in talent, technologies, and tools that empower you to own your career. Join MUFG where being inspired is expected and making a meaningful impact is rewarded. Qualifications Education: Degree or equivalent work experience equally preferable. Bachelors degree in Information Technology, Cyber Security, Computer Science or a related discipline. Certifications: Relevant technical and industry certifications preferred such as CISSP, ISSMP, SANS, GCIA, CISM, EnCE, CEH, GCFA, GCFE, GCIH, or GSEC. Work Experience: Experience working in a global, complex, matrixmanaged organization. Experience working directly in Cybersecurity Operations or Information Security. Experience in Incident Response and Forensic Investigations. Experience in threat and vulnerability management. Experience within the Financial Services Industry preferred. Experience in one or more security domains including Security Governance and Oversight, Security Risk Management, Network Security, Threat and Vulnerability Management, and Incident Response and Forensics. Experience with information security risk management, including conducting information security audits, reviews, and risk assessments. Functional Skills: Knowledge of IT security, incident handling and response, exploit analysis, intelligence gathering, and digital forensics methods and procedures. Familiarity with forensic security tools. Ability to document and explain technical details concisely and understandably. Knowledge of Information Assurance concepts and technologies. Knowledge of cloud computing security, network, operating system, database, application, and mobile device security. Knowledge of vulnerability management and remediation. Broad understanding of product security and information security, including system development and maintenance procedures, system software and hardware security controls, access controls, computer operations, physical and environmental controls, and backup and recovery procedures. Foundational Skills: Effective communication. Analytical, critical thinking, and decisionmaking skills. Sound judgment and continuous improvement focus. Optimism, resilience, flexibility, and openness to others ideas. Active listening and thoughtful questioning. Technology proficiency to achieve efficiency and results. Inclusive engagement and integrity. Analytical thinking and iterative problemsolving. Ability to serve as a trusted advisor. Responsibilities Examine computers, related hardware, network traffic, related applications, and operating systems to identify potential threats, anomalous or malicious activities; conduct strategic assessments on systems and networks; provide tactical analyses and suggestions; generate detailed reports for management; take effective measures to prevent and reduce cyber security incidents. Apply forensic methods and techniques to test hardware/software equipment, operating systems, and memory for electronic data trail detection, and device records tracing; collect and analyze investigative information and data to identify signs or sources of compromise, poor security practices, and unauthorized activities; conduct a range of data forensic investigations of information security incidents. Collect, document, assess, and analyze cyber threat information from various data sets; present reports and findings to management; recommend proactive practices to reduce computer crime. Execute firstlevel incident responses for reported and detected incidents; provide technical assistance to other incident response and security operation teams. Perform security audit on a regular basis to ensure compliance with cyber security policies and standards; provide reports and documents regarding network security incident details and outcomes; assist in troubleshooting problems and recommend vulnerability corrections. Reconstruct damaged computer systems and recover damaged or destroyed data; review forensic images; determine solutions for recovery of potentially relevant information. Review internal logs and alerts to detect potential cybersecurity events. Triage cases based on output from automated alerts, and determine when to escalate to Tier 2/3 resources. Monitor external service provider(s) activity to detect potential cybersecurity events. Assist with Do