Senior Digital Forensic and Incident Response Expert (Compromise Assessment & Rapid Response)

About Us

ERGO Technology & Services S.A. (ET&S S.A.) was established in January 2021 following the integration of ERGO Digital IT and Atena into one entity, leveraging the strengths and best practices of both companies.

ET&S S.A. belongs to the ET&SM technology holding of ERGO Group AG, supporting millions of internal and external customers with state-of-the-art IT solutions to everyday problems. We are dedicated to bring a digital innovations to every aspect of the landscape of insurance. Discover how we are implementing AI, IoT, Voice Recognition, Big Data science, advanced mobile solutions and much more to accommodate our customers’ future needs around the globe. See how you can be a part of the digital revolution and apply to join us today!

How you will get the job done

The Cyber Security Incident Response Team (CSIRT) of the ERGO Group AG will roll out a Compromise Assessment and Rapid Response (CA&RR) tool for various customers. As tool of choice, an industry-leading tool will be used to enable the ERGO Group AG to get a holistic view of current threads and to scan holistically for Indicators of Compromise and hunt down potential attackers. Furthermore, the technology will create new possibilities and capabilities to react to those threads for the whole ERGO Group.

In your function, you will support the CA&RR project during the project phase. During this phase, you will be responsible for managing initial scans, train the first level analysists and support the project lead for the whole build up phase. Furthermore, you will be responsible in all phases for the second level analysis of anomalies. In case there is a need for follow up activities and collection of evidences, you will be responsible for coordinating the evidence collection between the different international teams. In case of a security incident, you will also have the responsibility to develop and operationalize rapid response plans together with the other teams. In addition, you will develop YARA rules based on your analysis and assure the quality of the threat hunting & IOC scanning process and the correct grouping of anomalies into so-called cases using our technologies in the customer’s environment. Moreover, it is within your responsibility to develop a proper reporting framework as well as evolving the needed processes on a continuous basis.

In short your tasks will be

• scan management for a Compromise Assessment and Rapid Response (CA&RR) tool for various customers in the ERGO group
• development of rule-sets (i.e. custom YARA rules)
• development of rapid response playbooks
• 2^nd level analysis – Quality assurance of 1st level analysis and supervising of scoping activities
• deeper analysis of 1^st level findings in the CA&RR tool
• analysis of high sophisticated attacks and malware
• definition and application of containment strategies
• presentation of results and recommendations for different levels i. e. for upper management, technical teams as the Security Operation Center (SOC), the ERGO Group Incident Response & Digital Forensics (DFIR) team
• supporting remediation measures
• development of internal and external reporting
• supporting Service Management for customer satisfaction
• mentoring the 1^st level team and holding trainings for the other teams

Skills and experience you will need

• fluent in English
• proven experience in the IT security area
• at least 8 years of hands-on experience with hardware/software tools used in incident response, computer forensics, network security assessments
• mastering internals of Windows and Active Directory environments
• strong memory analysis skills
• strong Linux and macOS forensic skills
• strong network and systems analysis skills
• strong ability to work in a multinational and complex environment
• ability to coordinate people in different locations and at different stakeholder levels
• ability to present complex facts in a shot for different stakeholder levels
• ability to stay focused, keep calm and work under high stress
• must have a thorough understanding of network protocols, network devices, computer security devices, secure architecture; system administration
• mastering at least one programming language
• being an innovator, creative, passionate, independent and motivated to make a difference and help reducing cyber risk for ERGO Group

Desired Certification

• Bachelor / Master in IT / Business IT / Computer Science or similar education
• Certified in
  • CISSP,
  • GCFA,
  • GCIA,
  • GCFE,
  • GNFA,
  • GREM,
  • GCIH,
  • or equivalent