Incident Commander Engineer II

JOB PURPOSE

Careem’s Cyber fusion center team is the cybersecurity incident response body at Careem. Cyber fusion center team  responds to security incidents and mitigates security threats across the company. The Cyber fusion center team is made of three teams: vSOC (virtual Security Operations Center), Investigations and Automation, and Incident Command. You will be joining the Command team. As a Sr. Security Engineer - Command, you will be leading incident response strategy and communication, and will be helping to mature the program.

The successful candidate is expected to manage a broad range of cyber-security incidents as well as perform digital forensics and help advance Careem’s incident response processes and methodologies.

KEY ACCOUNTABILITIES

Responsibilities and Tasks: 

• Drive strategy of incident response for highest criticality cyber security events.
• Serve as point of contact throughout the incident lifecycle, interacting directly with executives.
• Conduct rapid response, mitigation, and investigations on the highest priority cases
• impacting Careem and user data.
• Partner with the team members across two regions to drive response and investigations globally.
• Support and mentor analysts conducting investigations.
• Manage multiple cases and projects at once while effectively prioritizing time.
• Produce concise yet detailed case reports for internal and external partners.
• You will be the incident response strategic expert for the cases you work.
• Drive strategy of incident response for highest criticality cyber security events.
• Serve as point of contact throughout the incident lifecycle, interacting directly with executives.
• Conduct rapid response, mitigation, and investigations on the highest priority cases impacting Careem and user data.
• Partner with the team members across two regions to drive response and investigations globally.
• Support and mentor analysts conducting investigations.
• Manage multiple cases and projects at once while effectively prioritizing time.
• Produce concise yet detailed case reports for internal and external partners.
• You will be the incident response strategic expert for the cases you work.
• Defining and implementing  policies and procedures, KPI’s, communication plans for Cyber security incidents response function.
• Manage all Cyber security incidents, leads investigation, coordinates incident response / remediation activities, recommends required actions and supports / follows up to ensure these are implemented.
• Managing resources and defining objectives at each stage of the incident response process; scoping and triage, containment, evidence preservation and extraction, eradication, recovery, forensic analysis and investigation.

Qualifications:

1. Minimum 5+ years of operational experience preferred in incident response , crisis management, security operations management,, threat management, cyber security, information security or related functions.
2. Bachelor's degree in Computer Science, Management Information Systems, Information Systems, or a related field/experience is required. Experience within financial services areas is preferred.
3. Strong knowledge of Security Methodologies and Frameworks.

Experience: 

Must have experience: 

• Experience in Highly available 24x7 Enterprise Operational Environment
• Must possess strong writing, and critical thinking/analysis skills
• Ability to effectively use data to visualize and communicate findings while maintaining data confidentiality, integrity and availability
• Experience as a security manager in a medium-to-large complex, fast-paced organization.
• Mature understanding of industry accepted standards for incident response actions and best practices related to SOC operations and DFIR functions.
• In-depth knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management etc.
• Strong leadership skills and the ability to lead and guide team during incident and crisis management

Proven success building and running incident response  function/team, including (but not limited to):

• Experience driving complex incidents to resolution end-to-end.
• Willingness to lead and mentor others.
• Must be highly experienced in the incident response lifecycle.
• Experience presenting incident strategy to an executive audience.
• Experience in incident response at a global company.
• Familiarity with technical forensic methodologies and software is a plus.
• Knowledge across multiple security domains is a plus.