D&T Analyst II – Cyber Security, Incident Response

Position Title D&T Analyst II, Cyber Security, Incident Response Function/Group Digital & Technology Location Mumbai Shift Timing 24x7 - rotating shifts Role Reports to Manager, Incident Response Remote/Hybrid/in-Office In-Office ABOUT GENERAL MILLS We make food the world loves: 100 brands. In 100 countries. Across six continents. With iconic brands like Cheerios, Pillsbury, Betty Crocker, Nature Valley, and Häagen-Dazs, we’ve been serving up food the world loves for 155 years (and counting). Each of our brands has a unique story to tell. How we make our food is as important as the food we make. Our values are baked into our legacy and continue to accelerate us into the future as an innovative force for good. General Mills was founded in 1866 when Cadwallader Washburn boldly bought the largest flour mill west of the Mississippi. That pioneering spirit lives on today through our leadership team who upholds a vision of relentless innovation while being a force for good. For more details check out General Mills India Center (GIC) is our global capability center in Mumbai that works as an extension of our global organization delivering business value, service excellence and growth, while standing for good for our planet and people. With our team of 1800+ professionals, we deliver superior value across the areas of Supply chain (SC) , Digital & Technology (D&T) Innovation, Technology & Quality (ITQ), Consumer and Market Intelligence (CMI), Sales Strategy & Intelligence (SSI) , Global Shared Services (GSS) , Finance Shared Services (FSS) and Human Resources Shared Services (HRSS).For more details check out We advocate for advancing equity and inclusion to create more equitable workplaces and a better tomorrow. JOB OVERVIEW KEY ACCOUNTABILITIES Monitor and investigate cyber security events · Direct incident response team while responding to more complex incidents · Handle escalations from other members of the incident response team · Monitor SIEM and other tools for potential threats, intrusions, or compromises · Analyze emails reported as phishing · Investigate the functionality, origin, potential impact and contain threats including malware, phishing, and other intrusions · Analyze malware in a sandbox environment to understand impact · Use General Mills forensic tools to understand how malware may have impacted a system · Review investigations performed by peers · Escalate cybersecurity events according to General Mills Cybersecurity Incident Response Plan Continuous improvement · Review investigations performed by other team members and recommend improvements · Fine tune detection rules · Lead SOAR Automation and process streamlining · Lead and participate in incident retrospectives · Develop reports on incident trends to share with other Cyber Security Teams · Recommend, prioritize, and implement solutions for process improvement · Recommend solutions to prevent threats observed by CSIRT · Participate in projects to implement new technologies Procedure Development, Refinement and Team Building · Acquire, apply, and share expert knowledge of the business, its products, and processes to incident response procedures · Maintain understanding of the global threat landscape and share it with the rest of the team · Develop incident investigation processes and playbooks · Ensure processes are clearly communicated, understood, and followed · Plan shift schedule · Train and Mentor other CSIRT members to improve their investigation skills · Support tools used in incident response · Train and mentor new team members · Hiring & On-boarding new talent Must - have technical skills and experience · Demonstrate ability to work in 24x7 facility in rotating shifts · Expertise in incident response processes and tools to detect, analyze, respond, and contain cyber security threats quickly and correctly · Expertise in forensic techniques used to analyze threats (including malware), to extract key indicators of attack and compromise · Experience with automating and scripting processes · Knowledge in tools and techniques used by attackers to gain unauthorized access to systems · Good understanding of Cyber Security principles and MITRE framework. · Prior experience with information security and associated technologies, including boundary protection (e.g. firewalls, proxies, IDS/IPS), endpoint protection, remote access, and security information and event management · Demonstrated ability to get things done both independently and in a collaborative, team-oriented environment · Skilled in mixed Microsoft and open-source operating system environments · Understanding of network protocols. · Good understanding of investigations Windows, Linux and MAC operating systems · Create better solutions through tireless curiosity and innovation stretching beyond your area of expertise MINIMUM QUALIFICATIONS Education – Full time graduation from an accredited university (Mandatory- Note: This is the minimum education criteria which cannot be altered) Technologies – SIEM/SOAR knowledge, Forensic investigation, malware analysis Related work experience – 5 to 8 years Well-versed with Incident response processes and framework Forensic techniques used to analyze threats (including malware) Knowledge on cloud security Automating and scripting using python, powershell Strong communication and interpersonal skills PREFERRED QUALIFICATIONS  - Certification like GIAC Certified Incident Handler (GCIH), Certified Information Systems Security Professional (CISSP) Certified Ethical Hacker (CEH), CompTIA Cybersecurity Analyst (CySA+), EC-Council Certified Incident Handler (ECIH)