As a CSIRT Officer you will join the CISO Cybersecurity Center of Excellence team within the NMBS CISO organization . You will contribute to the daily security incident preparation, detection and response activities including threat detection, incident handling, threat hunting as well as propose and execute improvement actions, interact with the staff of NMBS (including its affiliates) and the security services providers.


Incident handling and response

As member of a dynamic CSIRT team you will need to be able to respond adequately to cyber security incidents by working together with fellow CSIRT officers and any possible stakeholders.

This includes:

  • Investigate and respond to level 3/4security incidents, including malware infections, network intrusions, and data breaches
  • Conduct forensic investigations, coordination and analysis of security incidents, regardless of IT, IoT or OT origin
  • Work closely with other members of the SOC, CSIRT and with other teams within the organization, to identify and mitigate security risks
  • Develop and implement incident response plans & procedures, and provide guidance to other members of the organization on security best practices
  • Communicate and report security incident progress to required internal and external stakeholders

Threat detection and hunting

As the CSIRT officer, you will also be responsible for threat detection and hunting. You will use your expertise in security operations to proactively identify threats and vulnerabilities within the organization's infrastructure with the help of the SIEM and custom detection tools. This will involve conducting regular threat hunting exercises to detect potential threats that may have evaded detection by traditional security measures. You will use a variety of tools and techniques to collect and analyze security data to identify anomalous behavior and potential indicators of compromise. Additionally, you will work closely with the the 3rd party SOC team to investigate potential security incidents and provide guidance on threat remediation and mitigation strategies. You are able to read and understand logs (Windows, Linux, network , etc) to analyze system artifacts for signs of compromise.


SIEM Engineering

You will play a critical role to ensure the organization's security posture remains strong. You will develop, maintain, and optimize our SIEM systems to ensure timely detection and response to security incidents. This will involve creating and maintaining use cases and detection rules (based on the MITRE ATT&CK framework), as well as writing playbooks for the SOC team to ensure consistent and effective incident response. Additionally you will automate the response to SIEM and EDR events as much as possible, in order to allow the SOC and the CSIRT to focus on the essentials.


Projects

Next to the core business of our team activities mentioned above, you will also contribute in different projects based on the needs of our team. This can include rolling out a new products or platforms, maintaining it, automate manual tasks with the help of scripts, …

Vereisten

Skills:

  • Strong analytical and problem-solving skills, with the ability to identify and respond to security incidents in a timely and effective manner
  • Strong knowledge of security technologies and tools, such as SIEM, EDR, intrusion detection and prevention, firewalls, …
  • Strong understanding of networking protocols and technologies, as well as operating systems
  • Experience with security incident response tools and techniques, including forensics and/or malware analysis
  • Experience with threat hunting and the ability to identify and investigate suspicious activities on the network and systems
  • Experience with SOC Engineering and identifying gaps in our detection capabilities, as well as the ability to automate alert handling
  • Experience with one or more scripting languages: Python, Bash, PowerShell
  • Experience with query languages (Kusto Query Language, SPL, etc)
  • Experience with the administration of Linux systems
  • Familiar with cloud security concepts
  • Passionate about security monitoring, digital forensics, incident response, threat intelligence
  • Spoken and written fluency in Dutch or French
  • Spoken and written fluency in English
  • Customer focus and able to handle in an organization-sensitive way

Qualifications:

  • Bachelor's degree in Computer Science, Information Security, related field or equivalent experience
  • At least 3-5 years of experience in a security-related role, with a focus on incident response and analysis
  • Relevant certifications, such as the GCIH, GCFE, GCFA, GNFA, GCIA, GREM or similar are a plus


Our offer

Within our open corporate culture, you contribute to the digital transformation of SNCB. You will have a job with social impact and ample opportunity to make your own contribution. In addition to a good work-life balance and a competitive salary, you will receive the following benefits:

  • the possibility to work remotely + flexible working hours;
  • 35 days of leave;
  • a company car + a public transport season ticket;
  • a target bonus;
  • a comprehensive insurance package (affiliation without own contribution, excl. outpatient costs for family members);
    • hospitalisation and dental care for the whole family;
    • outpatient costs (= medical costs separate from hospitalisation);
    • group insurance: supplementary pension, work disability and death (cafeteria plan);
    • accidents at work (extralegal);
  • meal vouchers and eco-vouchers;
  • net allowances for remote working and carwash + internet budget.
Solliciteer voor deze vacature
Solliciteer voor deze vacature
Locatie icoon

Near Brussels Midi Station

Departement icoon

IT Security

Contract type icoon

fulltime_permanent

Nog een vraag?
Contacteer onze HR Business partner

Katrien Vandeput
Neem contact op

Deel deze vacature

FacebookWhatsAppEmailLinkedIn

3 redenen om te kiezen voor Ypto

Icoon uitdagingen: bergtop

Uitdagende projecten

Bij Ypto sta je nooit stil. Elke dag brengt afwisseling en een uitdaging om te innoveren en zo tot de beste oplossing te komen voor onze klant. 

Maatschappelijke impact icoon

Maatschappelijke impact

Je werkt mee aan de toekomst van de Belgische spoorwegen, en creëert een voelbare impact op miljoenen mensen.  

Doorgroeimogelijkheden icoon

Groeimogelijkheden

Initiatief, vertrouwen en zelf-sturing staan centraal. Je krijgt de steun van collega’s om jezelf te ontwikkelen en de mogelijkheid om te groeien. 

Sollicitatieprocedure

Heb je gesolliciteerd bij Ypto? Of ben je benieuwd naar hoe onze sollicitatieprocedure verloopt? De vier stappen hieronder worden telkens gevolgd. Afhankelijk van de functie kan er nog een gesprek of assessment bijkomen.

1

CV-screening

We  bekijken je cv grondig en gaan na of die aansluit bij het gezochte profiel. Het is mogelijk dat we je kort opbellen om te vragen naar je motivatie en ervaring. 

2

Gesprekken & vragenlijst

Na een positieve screening word je uitgenodigd voor een (video)gesprek met je rechtstreeks leidinggevende en je HR Business Partner. Tijdens deze gesprekken praten we over je motivatie, kennis, ervaring, vaardigheden en de inhoud van de functie. Ook bespreken we de online vragenlijst die je voorafgaand aan het gesprek hebt ingevuld. 

3

Referentieonderzoek

Tenslotte nemen we contact op met de door jou opgegeven referenties. Op die manier kunnen we ons een nog beter beeld vormen van jou.

4

We hebben een match: welkom bij Ypto!

Ben je geselecteerd? Dan maken we graag een aantrekkelijk voorstel op zodat we je met veel plezier kunnen verwelkomen in onze organisatie. 

Solliciteer spontaan

Wil je samen met ons werken aan de toekomst van NMBS, maar vind je niet meteen de juiste vacature? Solliciteer dan spontaan en wie weet behoor jij binnenkort wel tot ons team!