Task 3 - Security Incident Response (SIR) Implementation and Configuration
Scope:
Install the Security Incident Response (SIR) plug-in.
Integrate with Microsoft Azure Sentinel, Palo Alto Networks NGFW, and Splunk for alert ingestion.
Set up inbound email ingestion rules for SIR creation.
Configure groups, roles, and permissions for incident response.
Enable SIR process definition adhering to NIST and SANS frameworks.
Configure two (2) assignment and escalation rules.
Implement severity calculators and risk scoring to prioritize incidents effectively.
Configure up to three (3) Service Level Agreements (SLAs) for security incidents.
Configure one (1) post-incident review process.
Configure analysis tools.
Set up security tagging for access restriction.
Set up Threat Intelligence feeds from various STIX/TAXI feeds with the ability to ingest CTI from email sources.
Configure Out-Of-The-Box (OOB) notifications and up to five (5) additional customized notifications.
Configure two (2) task playbooks of moderate complexity.
Set up a runbook Knowledge Base (KB) and import existing runbooks.
Configure fields and workspaces for SIR.
Enable OOB reports and dashboards, and create up to five (5) additional reports.
Configure the security incident catalog.
Staff Training
US Citizenship and need to go through the clearance process
Job Types: Full-time, Contract
Pay: $150,000.00 - $200,000.00 per year
Benefits:
- 401(k)
- Dental insurance
- Health insurance
- Vision insurance
Education:
Experience:
- SNOW implementations: 3 years (Required)
- Software Development: 5 years (Required)
- ServiceNow Architecture (designing, developing, customizing) : 3 years (Required)
- Security Incident Response (SIR): 3 years (Required)
- Integrate with Azure/Splunk/Palo Alto Networks NGFW: 3 years (Required)
- Set up Threat Intelligence feeds: 3 years (Required)
- Configure fields and workspaces for SIR: 3 years (Required)
- Configure the security incident catalog and dashboards: 3 years (Required)
License/Certification:
- US Citizenship (Required)
- Can you work on W2 basis only (Required)
- Willing to get Clearance (Required)
- ServiceNow certification (Required)
Security clearance:
Ability to Commute:
- Morgantown, WV 26505 (Preferred)
Work Location: Hybrid remote in Morgantown, WV 26505
