Director - Digital, Data and Information Technology

Rakuten Group offers various services in e-commerce, fintech, digital content and communications to many users worldwide. highly advanced edge networks and platforms; and efficient operations using artificial intelligence (AI). Within Rakuten Symphony, Cyber Security is an organization that demonstrates excellence, innovation, and leadership in Cloud-Native Security, Networking and Automation for 5G and beyond. To support our ambitions to provide an innovative cloud-native telco platform for our customers, Rakuten Symphony is looking to recruit and develop top talent based in India. We are looking for passionate individuals to join our Cyber Security team to help incubate and develop security solutions aligning with our Innovation efforts. TSE: 4755) is a global leader in internet services that empower individuals, communities, businesses, and society. Founded in Tokyo in 1997 as an online marketplace, Rakuten has expanded to offer services in e-commerce, fintech, digital content and communications to approximately 1.5 billion members around the world. The Rakuten Group has over 27,000 employees, and operations in 30 countries and regions. As a member of our team, you will be responsible for digital forensics and incident response (DFIR) support across the 4G/5G mobility network for Rakuten Mobile in Japan. The team is looking for a highly technical individual to support our growing team in Japan and build a world class DFIR capability. Actively investigate security events and manage incident response and digital forensic investigations across a range of computing environments, platforms, and applications, including Windows, Linux-based operating systems, Mobile Devices, Open-Source Container Orchestration systems, public cloud software-as-a-service applications, and inhouse hosted infrastructure-as-a-service platforms. Perform security triage and forensic analysis of compromised computing environments and systems including Windows, Linux, Mac OS and Mobile devices. Forensically analyze end user systems and servers found to have possible indicators of compromise. Perform security reviews of firewall, web, database, and other log sources to identify evidence and artifacts of malicious and compromised activity. Collect and analyze data to identify cyber security flaws and vulnerabilities and make recommendations that enable prompt remediation. Perform memory forensics and binary file analysis as needed. Investigate and analyze malicious code and/or malware by performing malware analysis. Develop and maintain incident response and forensic activity plans, runbooks, and other preparedness documentation. Coordinate with server owners, system custodians, and IT/Network contacts to pursue security incident response activities, including obtaining access to systems, digital forensic artifact collection, and containment and/or remediation actions. Develop and maintain IR script repository to support automated forensic artifact collection and analysis. Provide support to prepare cyber security incident investigation report. Availability during nights/weekends as needed for DFIR activities. Conduct research and development on cyber security incidents and mitigations. Collaborate with others in the Security Operations department to develop and implement innovative strategies for monitoring and preventing attackers. Required qualities and skills: ~ Bachelor’s degree in Computer Science or related field. ~4-5 years of experience in Digital Forensics and Incident Response performing Incident Triage, Investigation, Evidence collection, analysis, and reporting. ~ Good understanding of data collection and preservation principles. ~ Proficient in the use of forensic tools such as FTK, EnCase, Axiom, X-Ways, Volatility, etc. ~ Experience with various forensic log artefacts found in SIEM logs, Firewall logs, web server logs, AV logs, protection logs such as HIDS and NIDS logs. ~ Prior experience using SIEM/EDR/XDR products (e.g., Splunk, QRadar, Crowdstrike, Carbon Black, Sentinel One, Tanium, Trend Micro, others) to investigate threats and perform triage activities. ~ Must have experience with scripting/programming in at least one language (e.g., Go, Python, PowerShell). ~ Microsoft Azure and/or Office 365 platform knowledge and experience. ~ Must possess strong experience in security engineering and network technologies, Operating Systems and network security, common attack patterns and exploitation techniques. ~ Must possess an understanding of all aspects of incident response and digital forensics, evidence handling procedures, conducting, and managing cyber investigations and case management. ~ Must be willing to participate in on-call rotation and work after hours as needed. ~ Ability to influence decision makers with data and objective analysis. ~ Must have a passion for research and uncovering the unknown about cyber security threats and threat actors. ~ Familiarity with Public Cloud platforms (GCP/AWS/Azure). ~ Knowledge of Containerization, Kubernetes, Docker is a plus. ~ Experience working in Telecom (MNO/MVNO) sector is preferable, but not required. Our worldwide practices describe specific behaviours that make Rakuten unique and united across the world.