SaskPower Looking for Specialist, Cyber Security & Investigations at Swift Current, Saskatchewan, Canada Full Time

At SaskPower, we generate more than just electricity for Saskatchewan people. We offer some of the best jobs in the province.

Our challenging careers will help you grow while being surrounded by a fully-committed team, committed to safety, openness, collaboration and accountability. If you’re someone who thrives in a team environment and doesn’t shy away from a good challenge, join us!

Apply no later than 09/20/2023to be considered for this opportunity.

This position falls within the requirement for Personnel Risk Assessment to meet compliance requirements of NERC-CIP (North American Electric Reliability Corporation Critical Infrastructure Protection). A Criminal Record Check must be valid and/or completed prior to being appointed to this position and then on a recurring basis every seven (7) years.

Job Summary

We are seeking an individual experienced in cyber security analysis and incident response to support daily operations and help grow and mature our Enterprise Security team. This position is located in Regina, Saskatchewan.

As a Cyber Security Specialist, you will be responsible for leading SIEM / SOAR cyber security monitoring in collaboration with our Operational Technology (OT) team(s). This will include identifying key logging and alerting capabilities generated by applications, servers and network appliances, evolving new detection methodologies, participating in threat actor investigations and providing expert support to incident response and (SIEM and SOAR) monitoring functions. The focus of the Cyber Security Specialist is to detect, disrupt and eradicate threat actors. As a member of a Cyber Security team, you will support the Enterprise Security team by applying analytic and technical skills to investigate intrusions, identify malicious activity (Cloud, email, network and endpoint), and perform incident response.

Key Accountabilities

• Lead the ingestion of new logs sources from our Operational Technology (OT) areas, and identify steps necessary to correlate the logs against “indicators of compromise”
• Lead team meetings with Operational Technology (OT) resources to identify how log sources can be used to detect anomalous or malicious actions
• General SIEM monitoring, analysis, and development of queries/dashboards.
• Research, analysis, and response for alerts; including log retrieval and documentation
• Work closely with our Operational Technology (OT) teams to understand strategic and tactical logging and alerting requirements that will support our cyber-security functions
• Conduct analysis of network traffic and host activity across a wide array of technologies and platforms
• Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts
• Compile approved detailed investigation and analysis reports for business, and delivery to management
• In coordination with other team members, track threat actors and associated tactics, techniques, and procedures (TTPs).
• Analyze network traffic, IDS/IPS/DLP events, packet capture, and FW logs.
• Analyze malicious campaigns and evaluate effectiveness of security technologies.
• Develop advanced queries and alerts to detect adversary actions. Review alerts generated by detection infrastructure for false positive alerts and modify alerts as needed.
• Coordinate threat hunting activities across the network leveraging intelligence from multiple internal and external sources, as well as cutting- edge security technologies.
• Lead response and investigation efforts into advanced/targeted attacks.
• Provide expert analytic investigative support of large scale and complex security incidents.

Knowledge/Skills/Abilities

• Degree in Computer Science or other related equivalent AND/OR;
• Related professional designation(s) and/or certification(s) AND/OR;
• 5+ years of relevant and documented cyber security experience in IT Security, Incident Response or network security.
• Considerable experience with the incident response process, including detecting advanced adversaries, log analysis using Splunk or similar tools such as Microsoft Sentinel.
• Strong analytical and investigation skills & active threat hunting and adversary tracking.
• Working knowledge of security architectures, devices and threat intelligence consumption and management within Cloud, network, email and endpoint.
• Working knowledge of root causes of malware infections and proactive mitigation.
• Working knowledge of lateral movement, footholds, and data exfiltration techniques.
• Track record of creative problem solving, and the desire to create and build new processes.
• Experience with packet flow, TCP/UDP traffic, firewall technologies, IPS technologies, proxy technologies, and Active Directory.
• Knowledge of the underlying logic that security alerts are built upon and apply them when analyzing raw logs and creating new dashboards and alerts.
• Knowledge of typical behaviors of both malware and threat actors and how common protocols and applications work at the network level, including DNS, HTTP, and SMB.
• Strong time management and multitasking skills as well as attention to detail as we well as strong collaborative skills and proven ability to work in a diverse team of cyber-security professionals.

Additional Experience

• Experience with one or more languages (e.g., Kusto Query Language (KQL), Splunk – SPL, Powershell, Python or Rest API)
• Demonstrated experience with creating automated log correlations in Splunk or a similar tool to identify anomalous and potentially malicious behavior.
• Demonstrated knowledge of the Splunk search language, search techniques, alerts, dashboards and report building.
• Convert intelligence into actionable mitigation and technical control recommendations.
• Understanding of Operational Technology (OT) and the communication protocols used.
• Perform memory acquisition and analysis
• Experience with Netflow or PCAP analysis.
• Experience with computer exploitation methodologies
• CISSP, CISM or a GIAC certification is preferred

A suitable combination of relevant education and experience may also be considered

Candidates under consideration may be required to participate in an assessment process consisting of any/all of the following: interview, abilities test, case study and/or presentation.

For More Information On These Job Family Competencies And Those That Relate To The Position That You Are Applying On,

SaskPower has identified competencies that enable performance and success within each out of scope role at SaskPower.

saskpower/Careers/Join-Our-Team/competencies

SaskPower offers a competitive salary and benefits package. Diversity and inclusion are also a priority for us. At SaskPower, we are committed to creating an inclusive workplace and having a workforce representative of the communities we serve. We are committed to selections based on merit and to the full participation of diversity groups. These groups include the four equity groups recognized by the Saskatchewan Human Rights Commission: Indigenous Peoples, Members of Visible Minority Groups / Racialized Groups, Persons with Disabilities and Women in Under-Represented Roles, as well as LGBTQ persons and Newcomers to Saskatchewan.

Visit our website for details.

To learn more about SaskPower, check us out on YouTube.

Keep posted on the latest job openings on LinkedIn.

Please apply by 09/20/2023.