Engineer 3 - Cyber Security Operations

Comcast brings together the best in media and technology. We drive innovation to create the world's best entertainment and online experiences. As a Fortune 50 leader, we set the pace in a variety of innovative and fascinating businesses and create career opportunities across a wide range of locations and disciplines. We are at the forefront of change and move at an amazing pace, thanks to our remarkable people, who bring cutting-edge products and services to life for millions of customers every day. If you share in our passion for teamwork, our vision to revolutionize industries and our goal to lead the future in media and technology, we want you to fast-forward your career at Comcast.

This job entails safeguarding network integrity by monitoring security events, identifying threats, and managing incident responses. It involves restoring systems post-incident, maintaining an advanced understanding of cyber threats, and continuously enhancing detection capabilities. The role includes performing security audits, risk analysis, and contributing to the development and implementation of innovative solutions. Additionally, it encompasses documenting processes, reporting to management, and setting performance standards within the cyber operations team.

Position: Engineer 3 - Cyber Security Operations Experience: 5 to 7.5 years Key Responsibilities Investigate and respond to security incidents from SIEM, EDR, email, cloud and network security tools. Perform alert triage and determine the severity and impact of incidents. Coordinate containment, eradication and recovery activities with IT teams. Document investigation findings and maintain incident records. Escalate complex incidents to the L3 Incident Response team. Support phishing, malware and account compromise investigations. Assist in developing and improving incident response playbooks. Provide guidance to L1 analysts during investigations. Meet incident response SLAs and participate in on-call support.

Bachelor's degree in Computer Science, Cybersecurity or related field. 3–5 years of experience in SOC or Incident Response. Knowledge of SIEM, EDR, Windows, Linux and networking. Understanding of MITRE ATT&CK and incident response lifecycle.

Monitoring network security events, analyzing alerts for potential threats, and restoring systems post-incident to maintain robust threat detection Performing internal and external service requests Maintaining advanced knowledge of cyber threats, and continuously researching to stay ahead of emerging technologies Documenting vulnerabilities for operational use, evaluating event flows for risks, and developing solutions to enhance security posture Assisting with security audits, conducting risk analyses, and performing network forensics and penetration testing to identify vulnerabilities Collaborating with cross-functional teams to refine incident response protocols and ensure the cybersecurity measures are effective against new threats Implementing security measures like intrusion detection systems and firewalls to safeguard network integrity and confidentiality Documenting incident reports, conducting After Action Reviews, and reporting findings to management to improve response processes Recommending innovative solutions and utilizing resources to resolve moderate development problems, setting performance standards for Cyber Operations staff Consistent exercise of independent judgment and discretion in matters of significance. Regular, consistent and punctual attendance. Must be able to work nights and weekends, variable schedule(s) as necessary. Other duties and responsibilities as assigned. Employees at all levels are expected to: Understand our Operating Principles; make them the guidelines for how you do your job. Own the customer experience think and act in ways that put our customers first, give them seamless digital options at every touchpoint, and make them