Career

Kazakhstan's largest investment bank, JSC "Halyk Finance", invites talented professionals to join the team!

What you will be responsible for:

Monitoring and processing alerts in SIEM, as well as AV, WAF, FW consoles and other security tools
Initial analysis and triage of security events: distinguishing false positives from real incidents, initial criticality assessment, and prioritization
Identifying suspicious activity in network traffic (scanning, C2 communications, DNS tunneling, unusual data transfer volumes, lateral movement)
Registering confirmed incidents, maintaining records, and adhering to SLA response and processing times
Performing standard response actions (host isolation, blocking accounts, IPs, domains, hashes)
Responding to security incidents at all stages of the lifecycle: detection, analysis, containment, eradication, recovery, and post-incident review
In-depth analysis and investigation of security incidents, determining the initial compromise vector, scope, affected assets and accounts, and building an attack timeline
Conducting basic digital forensics: analyzing disk images, OS artifacts (Windows Event Logs, Prefetch, Amcache, Registry, Linux auth/audit logs), and network dumps (PCAP)
Analyzing suspicious files, scripts, and attachments, including in a sandbox
Preparing incident reports with descriptions of the timeline, root cause, impact, and recommendations for remediation and prevention
Monitoring the implementation of post-incident recommendations by related departments (IT, network administrators, system owners)
Interacting with MSSP providers when resolving issues with connected event sources, ensuring log quality and completeness

We expect from you:

Ability to think structurally, build logical chains, and justify conclusions with sound reasoning
Experience in responding to and investigating security incidents
Experience working with any popular SIEM system (Splunk, QRadar, Elastic, Wazuh, etc.) as an engineer or analyst
Ability to read and interpret logs, understanding how specific logs can be used to write correlation rules or exclude false positives
Ability to analyze event and log records across various systems (OS, security tools, network equipment, etc.)
Experience working with information security tools: WAF, FW, SIEM, antivirus, and others
Understanding of key attack vectors on corporate networks and countermeasures
Knowledge of modern methods for classifying attacker tactics and techniques (MITRE ATT&CK, Cyber Kill Chain), detection, and mitigation
Basic Linux and Windows OS administration skills, understanding OS security mechanisms (authentication, access rights, auditing, Active Directory)
Understanding of network protocols and the TCP/IP stack (DNS, HTTP/S, SMB, RDP, Kerberos, LDAP, etc.)
English language proficiency sufficient to read technical documentation

It will be a plus:

Basic scripting skills (Python, PowerShell, Bash)
Experience in proactive threat hunting based on hypotheses and alignment with MITRE ATT&CK
Basic knowledge/experience in malware analysis
Relevant certifications
Skills in writing queries and rules (SPL)

We offer:

Employment in a stable and large company;
A strong team of professionals and exciting challenges;
An annual bonus and a holiday bonus;
Health insurance after the probation period;
26 days of paid annual leave;
Medical check-up after one year of employment;
Favorable corporate parking conditions;
Open corporate culture: sports tournaments, yoga, football, volleyball, participation in quizzes, and other corporate events;
Professional development: training, internal and external education

Lead Specialist of the Information Security Incident Response Service