Vice President, Threat Management, Application Monitoring & Response, Global Information Security, Sydney

to align with the nature of the support provided by the team.

Flexibility may occasionally be required to support business, operational, or project deliverables.

Job Description:

The Global Information Security (GIS) team is responsible for protecting bank information systems, confidential and proprietary data, and customer information.

The Cyber Security Defense (CSD) team aims to protect the bank by having an end-to-end view and influence over all security controls at the Bank.

The CSD Information Security Threat Management team specifically aims to reduce risk across the Bank of America by leveraging multiple methods of application layer intrusion detection, prevention and response activities for the security, safeguarding, continuity and confidentiality of information at Bank of America.

As senior member of the team, you can expect yourself to be on forefront of application security detection and response practice while collaborating with other security teams.

The CSD team operates in FTS (follow the sun) model among Australia, Singapore, UK and US. We are a front-line cyber response team that handles active security events and highly current threats.

Responsibilities:

• Analyze application layer alerts, conduct investigations, respond to disrupt malicious actions of threat actors and feedback to improve defensive capabilities
• Leverage advanced investigative skills using best in class data correlation and network/packet analysis tools to investigate incidents
• Provides leadership in assessing new threat vectors and leverage new intelligence to update existing controls, design new controls and participate in testing and deployment of new controls
• Develop and implement custom alerts and dashboards monitoring controls based on OSI layer 7 attack and threat indicators
• Responsible for mentoring and developing the skill sets of less experienced team members
• Develops and implements processes or controls in support of audit, compliance and risk requirements
• Partner with senior leaders of business organizations to triage security events and report on impact
• Execute and improve relevant risk management strategies

• Strong hands-on experience in application security detection and response technologies and processes
• Understanding of common exploits, web application attacks, network protocols and infrastructure/application logs (eg weblogs, AD logs, security logs) for an efficient intrusion analysis
• Advanced log analysis skills leveraging tools such as Splunk or other SIEM solutions to find targeted attacks and hunting exercises
• Experience of maintaining and fine-tuning signatures on WAF of leading vendors such as FE (ASM) and Akamai
• Comfortable with scripting languages and regular expressions
• Working knowledge of common operating systems (Windows/Linux/ OS X)
• Experience in packet captures and analysis (e.g. Wireshark) is desirable
• Ability to independently work in a fast-paced environment and drive continuous improvement
• Relevant technical certifications (SANS, CISSP, etc.) desirable
• Excellent verbal and written communication skills, able to adapt a message to various audiences