Senior Security Incident Response Specialist (6 months) - Flutter Functions, Hybrid & Remote

Senior Security Incident Response Specialist (6 months) - Flutter Functions, Hybrid & RemoteCyber Security Senior Specialist

Role Overview: 
Flutter is recruiting a Sr Incident Response Specialist to uplift and mature its cybersecurity capabilities across a global organization. This role will be to own the end-to-end Incident Response process, Preparation, Detection and Analysis, Containment, Eradication, Recovery and Post-Incident Activities, play a big part in improving how we log, detect and respond to threats from various platforms and help drive forward our NIST CSF maturity score. They must be comfortable working with cross-functional global teams in dynamic organisations, as the role will have interdependencies with teams in AWS, our partners, our internal engineering, security and business supporting teams across various functions in various brands across Flutter globally.
The ideal candidate will have experience working with enterprise organisations on large-scale migration/modernisation transformation projects, with a strong emphasis on cybersecurity. This role demands a customer-centric and collaborative approach, a deep technical understanding of cloud security solutions, and a passion for transforming business using cloud technologies.

Key Accountabilities & Responsabilities:

• Own and conduct deep-dive investigations into complex security incidents by correlating events logs to understand attacker activity, scope, and impact.
• Perform forensics analysis on identified threats to determine root cause and work with different teams on containment and remediation steps.
• Identify missed detection opportunities or gaps in visibility and work with detections engineers and platform teams to propose and test improvements.
• Work with the team to asses current-state monitoring and response workflows, contribute to updates or creation of IR and monitoring playbooks, escalation paths and log coverage frameworks/ processes.
• Align work with broader NIST CSF maturity uplift goals – especially in the Detect and Respond domains.
• Maintain accurate, usefull documentation around detection, incident timelines, and operational processes.
• Collaborate with engineering, DevOps and platform teams.

Skills, Capabilities & Experience Required: 

• Building Support: We establish close relationships with our stakeholders, underpinned by trust, integrity, and respect. We are able to build awareness, understanding, and positive momentum behind the group technology strategy, often without being in a position to assert authority.
• Objective: We are impartial and unbiased, ensuring equal treatment for all and that decisions are based on objective criteria.
• Collaborative: We work effectively and in partnership with our stakeholders on shared goals that align towards the achievement of the group strategy. We foster a collaborative environment and assume the role of leader when required.
• Adaptable: We understand and appreciate different and opposing perspectives on an issue and are able to adapt our approach in order to achieve a successful outcome.
• Strategic Thinking: We think about the big picture and use that perspective to support our divisions to achieve competitive advantage through greater agility, faster time to market and a better customer experience.
• Strategic Communication: We are proactive and considered in our approach to stakeholder communications. We actively listen, provide constructive feedback and help others to consider new perspectives.

Experience:

• Proven experience with SIEM platforms, (preferably Splunk) for analysis, log ingestion, detection creation and dashboarding.
• Experience performing security investigations, threat hunting, and incident response in the context of large organizations.
• Understanding of Tactics, Techniques, and Procedures (TTPs) used by threat actors or groups.
• Knowledge of host and network telemetry data (e.g., process lists, application logs, NetFlow).
• Incident Response experience in AWS environments (CloudTrail, VPC Flow Logs, GuardDuty, SecHub)
• Solid understanding of Github audit logs and what abnormal or malicious behavior looks like accross CI/CD workflows.
• Strong understanding on how to interpret offensive testing and translate them into actionable detection improvements.
• Knowledge of MITTRE ATT&CK and how to map detections effectively.
• Ability to work under pressure in fast-paced environments with high stakeholder visibility.
• Experience with documenting workflows, frameworks, detection logic and new processes.