Information Systems Security Analyst (reserve list)

Vacancy Notice 1928

INTERPOL is the world’s largest international police organization, with 196 Member Countries. Created in 1923, it facilitates cross-border police co-operation, and supports and assists all organizations, authorities, and services whose mission is to prevent or combat international crime.

INTERPOL actively encourages applications from women and nationals of member countries that are currently unrepresented among our staff (please click on this link to access the list of countries). Candidates from these countries are particularly encouraged to apply.

INTERPOL’s recruitment process is merit-based hence all hiring decisions are made considering the applicant’s qualifications and the needs of the Organization.

Job Title: Information Systems Security Analyst (reserve list)
Reporting To: Security Operations Center Manager
Location: Lyon
Type of contract: Fixed-term and short-term contracts*
Duration (in months): Different duration possible depending on future needs, up to 3 years*
Grade: 5

Number of post: Roster
Level of Security screening: Enhanced
Deadline for application: 23 August 2026

Conditions applying for all candidates

Only professional experience for which candidates can provide official proof of employment will be considered. Candidates could be requested to provide copies of such official documents prior to interviews/test.

*This selection exercise will be used to generate a list of recommended candidates aimed at addressing the Organization's staffing needs in the future. If recommended and the offered a post, any potential subsequent extension beyond the initial contract will be subject to the terms of the Organization’s Staff Manual, to satisfactory performance and to availability of funds.

Tests/interviews in connection to this selection procedure will take place approximately 1/3 weeks after the deadline for applications. Applicants are kindly requested to plan their availability during this period accordingly, in case they are short-listed.

​Selected candidates will be expected to report for duty approximately one to three months after receiving an offer of employment at the latest.

This selection exercise may be used to generate a reserve list of suitable candidates that may be used to address Organization's similar staffing needs in the future.

SUMMARY OF THE ASSIGNED DUTIES, INCLUDING GOALS AND OBJECTIVES OF THE POST

The post-holder reports to the Security Operations Center Manager.

The Information Systems Security Analyst must know how to source, install and maintain various security systems, including but not limited to unified threat management (UTM), messaging gateway, security information and event management (SIEM), encryption system and endpoint security.

As part of the Security Operations Center (SOC) team, the Information Systems Security Analyst is required to observe server logs, firewall logs, intrusion detection logs, web filtering and antiviral systems for any unusual or suspicious activity, in order to prevent compromise. Conducting Incident Management, Business Impact Analysis (BIA) and Disaster Recovery Planning (DRP) is crucial, as well as ensuring that recovery configurations are updated frequently.

Information Systems Security Analyst is obligated to monitor external sources to find available security patches and are to prioritize and make recommendations for implementation.
Finally, it is expected that Information Systems Security Analyst demonstrates knowledge in the planning and creation of organization security documents and architecture. It is important to remain up to date with detailed knowledge of the IT security industry. This includes the awareness of new or updated security solutions, improved security processes and the development of new attacks and threat vectors.

PRINCIPAL DUTIES AND ACTIVITIES

Mission 1: Security and Collaboration in Operations

• Participate in Security Operations Center (SOC) activities, SOC process improvement, and support on-call duties/shift working time.
• Monitor computer security risks, network events, and signals from security tools to identify probable security incidents and communicate information to relevant stakeholders as necessary.
• Respond to IT security incidents, review daily alerts, perform triage, carry out in-depth investigations on security events, and comply with Interpol's Incident Management Process.
• Evaluate events, incidents, and attacks, identify the root cause of the attack, implement required security actions to counter the attack, and restore system operations.
• Proactively explore weaknesses and vulnerabilities in IT infrastructure.
• Analyze threats and catch indicators of compromise, indicators of attack and advanced persistent threats.
• Provide strategy for containment, eradication, and recovery procedures based on the Disaster Recovery Plan.
• Ensure technology watch to remain up-to-date with new developments, trends, and techniques in the domain of IT security.

Mission 2: Security Engineering

• Maintain, configure and fine-tune IT security tools and related products, for example (not exhaustive): SIEM, SIM, UEBA, SOAR, Reverse Proxies, Directories, Identity Management, Identity Access, Antivirus, Vulnerability scanners, PKI, Authentication, Application Firewalls, etc.
• Perform SIEM implementation and management: rules, logic, actions and alert creation to detect potential security incidents across the organization.
• Gather requirements, perform troubleshooting, aid with the creation of SIEM search queries, improve the effectiveness and quality of the current detections, and reduce numbers of false positives.
• Ensure that proper use cases, operational controls, procedures, tests and documentations are in place to quickly move from test to production.
• Proactively seek to improve and develop new strategy based upon observed security events.
• Perform deep data analysis to gain valuable understanding of the data.
• Request to onboard new data sources into the SIEM.
• Perform automated health checks, and ensure effectiveness of events and incident detection.

Mission 3: Security and Risk Management

• Assist the SOC Manager by ensuring feasibility and coherence between organizational security polices and those of the IS&T Operations Sub-Directorate.
• Propose mitigation steps based on presented Risk Assessments.
• Participate in initiatives to inform and train colleagues about security awareness and best practices.
• Assist the SOC Manager in drafting and maintaining various internal Standard Operating Procedures.
• Assist the SOC Manager to the contribution to the IS Directorate yearly business plan and roadmaps.
• Liaise with the SOC Manager in order to escalate any strategic IT security risks linked to technology or within the scope of work of the IS&T directorate.
• Execute the relevant security audits, assessments, penetration tests etc. and advise the SOC Manager on corrective actions or enhancements to IT products or projects.

Perform any other duties as required by the SOC Manager.

QUALIFICATIONS, COMPETENCIES AND SKILLS

EDUCATION AND QUALIFICATION REQUIRED

• Three-to-four years’ education at a University or other specialized higher education establishment, in the field of software engineering, computer science, information technology, information security, mathematics, engineering or a related field preferred.
• One or more internationally recognized IT Security Certifications (CISM, CISSP, CEH, etc.)

EXPERIENCE REQUIRED

• At least three years of experience in the IT security field is required. Preferably having already worked in a Security Operations Center (SOC).

LANGUAGES

• Fluency in English (written and spoken). Proficiency in another official working language of the Organization (French, Arabic, and Spanish) would be an additional asset.

SPECIAL APTITUDES REQUIRED

• The post holder must be a person of the highest integrity. Discretion and confidentiality are of paramount importance to this post.
• Excellent communication skills are required including the ability to compromise on less significant matters whilst maintaining a strong position on important security issues.
• Ability to prioritize accordingly
• Personal and professional maturity;
• Ability to maintain objectivity and apply logical reasoning;
• Ability to work in teams as well as individually
• Ability to work under pressure;
• Good social skills, particularly in a multicultural environment
• Initiative, creativity (original thinking) and curiosity;
• Ability to develop and maintain professional networks;
• Ability to synthesize;
• Good listening skills.

ABILITIES REQUIRED

• The ideal candidate would have all of the following, however candidates with a very strong background in some of the following will also be considered:
• Knowledge of the “defense in depth” approach to security.
• Experience of cryptographic solutions, accreditation and certification, and IT Security techniques and best practices.
• Experience of IT risk management.
• Technical expertise in Network & Security Infrastructure components: Web Servers, Reverse Proxies, Firewalls, Web Application Firewalls, Authentication, SSO, PKI, SIEM, etc.
• Excellent knowledge of Common protocols and their implementation: HTTP, LDAP, DNS, DHCP, etc.
• Knowledge of cloud security principles and techniques.
• An understanding of server and storage technologies: NAS and SAN storage, Distributed File Systems, Server Virtualization, Containerization, Databases, Mail servers and Backups.
• Experience working in DevSecOps environment.

As part of our commitment to transparency throughout our recruitment process, INTERPOL's Staff Manual Regulation 11.4: Age-limit, which states that:

'Officials of the Organization shall not normally be retained in service beyond the age of 65 years. The Secretary General may, in exceptional cases and in the interests of the Organization, extend this age limit, in which case he shall inform the official concerned sufficiently in advance.'

Given this Regulation and in case candidates reach the age of 65 during the potential duration of the appointment, should they be selected for the position and the process proceed to appointment, the employment period may be affected by this regulatory limit and may therefore not extend for the full standard contract duration as published in the vacancy notice.

We are sharing this information to ensure transparency at this stage of the process.