Consultant - Cyber Security Operations

Organizational Setting

The Division of Information Technology provides support to the IAEA in the field of information and communication technology (ICT), including information systems for technical programmes and management. It is responsible for planning, developing and implementing an ICT strategy, for setting and enforcing common ICT standards throughout the Secretariat and for managing central ICT services. The IAEA's ICT infrastructure comprises hardware and software platforms, and cloud and externally hosted services. The Division has implemented an IT service management model based on ITIL (IT Infrastructure Library) and Prince2 (Projects in a Controlled Environment) best practices.
The Infrastructure Services Section (ISS) is responsible for implementing, maintaining, and administering the ICT systems and services for high availability; designing, implementing, and operating IT security services; and managing the data centre. The platforms include Microsoft Windows servers, Linux servers, Oracle EBS infrastructure, data storage, and transmission networks, serving more than 2500 staff, as well as over 10000 external users around the world. The Section includes three Units: Network and Telecommunications, Enterprise Systems, and Security Systems.

Main Purpose

The consultant will be in the Security Systems Unit, providing support and expertise in incident response and IT security systems operations.
The consultant will be responsible for in-depth analysis, collecting and interpreting data and alerts triggered by our security monitoring tools, independently and in close collaboration with service providers inside and outside of IAEA. Additionally, the consultant will use their technical expertise and experience to enhance the systems and operations they work with, in close collaboration with the rest of the security team.

Functions / Key Results Expected

The consultant will perform the following functions:
• Collect and analyse evidence including network traffic, volatile data, logs, and other indicators of compromise in order to identify security threats.
• Perform real-time analysis and correlation of events from a multitude of data sources with a focus on identifying new indicators of compromise and detecting anomalies and potential security incidents.
• Provide technical resolution or escalation of security investigation tickets, ensuring that proper containment, eradication, recovery and lesson-learned activities are maintained.
• Conduct threat hunting exercises across the IAEA's environment based on external threat intelligence and in-house research.
• Suggest opportunities to improve security detection & monitoring capabilities, based on observations, and provide recommendations on tuning of signatures, rules and alerts.
• Propose solutions on creative ways to do work faster, better and more effectively while maintaining a high quality of service.
• Review and update documentation, work instructions, and SOPs for relevant tasks, and provide ongoing reporting to senior management.

Qualifications, Experience and Language skills

• A first level university degree in Computer Science, Information Technology or related field highly desirable.
• Minimum 5 years of relevant experience with at least 2 years' experience related to operational security monitoring, incident response experience, technical threat intelligence, or security research.
• Demonstrated experience conducting security analysis, incident response and/or digital forensics, making use of a broad range of data sources and technologies.
• Demonstrated experience using intrusion detection, security information and event management (SIEM) systems, endpoint detection and response (EDR), and other relevant security tools.
• Demonstrated ability to drive changes and provide tangible results.
• Excellent problem-solving skills and experience diagnosing and solving technical issues.
• Strong verbal and written communication skills with ability to communicate effectively and clearly to executive leadership.
• Technical understanding of network fundamentals and common internet protocols.
• Experience with one or more programming or scripting languages is desirable.
• Excellent knowledge of English. Knowledge of other official IAEA languages (Arabic, Chinese, French, Spanish and Russian) an asset.

Remuneration

The remuneration for this consultancy is a daily fee of up to a maximum of € 250, based on qualifications and experience. In case duty travel is required within the assignment, a daily subsistence allowance (DSA) and travel costs are provided. Health coverage and pension fund are the responsibility of the incumbent.