AstraZeneca
AstraZeneca is a global, science-led biopharmaceutical business and our innovative medicines are used by millions of patients worldwide.
AstraZeneca is a global, innovation-driven pharmaceutical business that focuses on the discovery, development, and commercialization of prescription medicines for some of the world’s most serious diseases.
At AstraZeneca, we are dedicated to being a Great Place to Work, where you are empowered to push the boundaries of science and unleash your ambitious spirit. There’s no better place to make a difference to securing medicine, patients, and society. An inclusive culture that champions diversity and collaboration, AstraZeneca is always committed to lifelong learning, growth, and development.
The Enterprise Technology Services Team is accountable for all Security, IT Operations, Infrastructure, and End User Services and Technologies. This group ensures that our IT Services are seamless and secure, and that technology is delivered efficiently, effectively, and agilely, with a strong focus on experience. It’s a dynamic and challenging environment to work in with countless opportunities to learn and grow.
Introduction To Role
Cybersecurity Defence Operations (CSDO), which sits within ETS, is fundamental to enterprise information security and is responsible for detecting, analyzing, and responding to real or potential security incidents. The Insider Threat Management (ITM) Analyst specializes in the collection and analysis of incidents to proactively identify and mitigate potential data breaches at AstraZeneca.
Accountabilities
1. Design and implement threat detection mechanisms across cloud, on-premises, and third-party collaboration platforms to identify suspicious activities and potential threats.
2. Develop, test, and deploy high fidelity signature and anomaly-based detections.
3. Partner with engineering teams to build and maintain pipelines for collecting and processing relevant security telemetry.
4. Research emerging threat vectors and align detection and response capabilities with the evolving threat landscape.
5. Continuously refine detection rules and address systemic issues by collaborating with engineering teams.
6. Automate detection and response workflows, including playbooks and processes.
7. Facilitate log data onboarding into the SIEM.
8. Correlate and analyze data from diverse sources to uncover threats.
9. Enhance detection workflows with automation and enriched alerts.
10. Leverage expertise across multiple security domains, focusing on two or more areas such as detection engineering, digital forensics, incident response, threat hunting, threat intelligence, or malware analysis.
11. Prepare reports and metrics related to threat detection efficacy and coverage.
Essential Skills & Experience
* Significant experience in Security Incident Response and Detection Engineering.
* Degree in Computer Science, Information Security, Cybersecurity, or equivalent experience.
* Eager to learn new technologies and methodologies to counter evolving threats.
* Strong English communication and interpersonal skills to collaborate with cross-functional teams and explain technical concepts to non-technical audiences.
* Experience creating detection rules using SPL, KQL, or Tanium signals, including tuning and correlation.
* Strong knowledge of MITRE ATT&CK and adversary tactics, techniques, and procedures.
* Hands-on experience with EDR tools such as Microsoft Defender for Endpoint, Tanium, and Trend Micro.
* Ability to assess diverse data sources to develop relevant and impactful detections.
* Strong understanding of false positive vs. true positive alerts.
* In-depth knowledge of antimalware, EDR, firewalls, proxies, IDS/IPS, Windows/Linux OS, Active Directory, and cloud environments.
Desirable Skills & Experience
* Experience with SIEM and SOAR platforms (e.g., Splunk).
* Proficiency in programming and scripting languages, including expertise in using Regular Expressions (REGEX).
* Previous experience collaborating with the Cyber Threat Intelligence (CTI) team to develop intelligence-driven threat detections.
When we put unexpected teams in the same room, we unleash bold thinking with the power to inspire life-changing medicines. In-person working gives us the platform we need to connect, work at pace, and challenge perceptions. That's why we work, on average, a minimum of three days per week from the office, while balancing individual flexibility.
At AstraZeneca, when we see an opportunity for change, we seize it and make it happen. Protecting the people, processes, and technologies required to develop and deliver life-changing medicines is about being entrepreneurial - finding those moments and recognizing their potential. Join us on our journey of building a new kind of organization to reset expectations of what cybersecurity can look like.
Ready to make an impact?
Apply now!
Date Posted: 07-Feb-2025
Closing Date: 21-Feb-2025
Our mission is to build an inclusive and equitable environment. We welcome and consider applications from all qualified candidates, regardless of characteristics. We offer reasonable adjustments/accommodations to help all candidates perform at their best.
#J-18808-Ljbffr