Tier 3 Incident Handler

Incident Classification - Examine and classify security incidents using the correct priorities to ensure response to the most important incidents
- Incident Capture and Aggregation from an established alert system, support group, etc.
- Secondary Triage of captured incidents
- Classify incidents
- Individual classification matrix
- Multiple classification matrix
- Prioritization based on establish severity matrix
- Preparation of incident report
Incident Prioritization- Analysis of security incidents to determine whether it is appropriate to react to a given situation, and formulate- Collection of information for rapid response (based on priority)
- Devise rapid response based on response matrix
- Prepare Vulnerability report
Incident Remediation - Immediate stoppage of critical incidents
- Stop the incident source
- Capture or lock-down of evidentiary material
- Transition to incident analysis
Incident Analysis- root cause determination and analysis of evidentiary material
- Examine evidentiary material and log files
- Identify affected elements
- Research technical documents or advisories
- Execution according to analysis stop criteria
- Isolate evidentiary material
- Prepare announcement recommendations
Incident Prevention - Revise policies and controls to meet the needs of the situation
- Research investigation results
- Identify countermeasures, workarounds, and fixes
- Develop implementation plans
- Provide technical assistance
- Verification of countermeasures
- Preparation of Prevention Report
Incident Handling Optimization - Revise incident handling procedures to include discovered variances and exceptions.
- Quality review of incident handling processes and procedures
- Identification of procedural change options
- Hypothetical analysis of change options
- Preparation of procedural and/or training change recommendations
- Preparation of incident and case reporting
Requirements:
8 -10 years experience related IDS Analysis experience Required Skills:
Strong IDS Monitoring/Analysis experience Desired Skills:
SIM experience and NetWitness experience