Re:Sources is the backbone of Publicis Groupe, the world’s third-largest communications group. Formed in 1998 as a small team to service a few Publicis Groupe firms, Re:Sources has grown to 4,000+ people servicing a global network of prestigious advertising, public relations, media, healthcare and digital marketing agencies. We provide technology solutions and business services including finance, accounting, legal, benefits, procurement, tax, real estate, treasury and risk management to help Publicis Groupe agencies do what they do best: create and innovate for their clients. In addition to providing essential, everyday services to our agencies,
Re:Sources develops and implements platforms, applications and tools to enhance productivity, encourage collaboration and enable professional and personal development. We continually transform to keep pace with our ever-changing communications industry and thrive on a spirit of innovation felt around the globe. With our support, Publicis Groupe agencies continue to create and deliver award-winning campaigns for their clients.
Overview
The Senior Associate, Information Security is part of a global team and is responsible for incident response of cyber security incidents that are associated with our businesses, clients, and vendors; is technically skilled and ensures incident containment, remediation, and closure. This individual will be expected to work closely with the legal, data privacy, business, and client teams. They should be comfortable with interacting with senior executives, including C-level staff.
Responsibilities
Incident Leadership
- Serve as the Incident Commander, leading the investigation and response to cybersecurity incidents.
- Manage, review, and present written and oral reports in a clear, concise, and accurate manner for distribution to management.
Forensic Analysis & Investigation
- Analyze compromised or potentially compromised systems to identify indicators of compromise and attack vectors.
- Perform complex forensic investigations into system breaches, data leaks, and system weaknesses.
Evidence Handling & Documentation
- Coordinate evidence and data gathering to support incident investigations.
- Document security incident reports with accuracy, completeness, and adherence to established protocols.
Threat Intelligence & Continuous Learning
- Maintain current knowledge of attacker tools, techniques, and procedures (TTPs), advanced persistent threats, and best practices in forensics and incident response.
Technical Guidance & Support
- Provide technical expertise to staff on security incident monitoring, triage, response processes, threat and vulnerability management, and security analysis.
Process Optimization & Strategic Direction
- Provide strategic direction regarding incident management activities that increase operational efficiency across the company.
- Champion opportunities for automation and workflow optimization, including the use of AI tools to streamline response efforts.
Qualifications
- EDR Experience- CrowdStrike and/or SentinelOne with experience investigating and analyzing malware and other malicious activity.
- 4 or more years of experience in an analytical role of either forensics analyst (Linux, Windows, or MacOS), threat analyst, incident response, SOC analyst, or security engineer/ consultant.
- Experience with cloud environments such as: Azure, AWS, GCP – knowing how to collect and analyze logs from Guard Duty/ Defender and CloudTrail, etc.
- Experience with system and application log and artifact collection and analysis (Windows, Linux, Mac, etc.).
- Familiarity with the MITRE ATT&CK or related frameworks.
- Experience developing and managing incident response programs with focus on efficiency through AI development.
- Strong communication skills with confidence leading Incident Response calls with different stakeholders; followed by producing detailed incident reports.
- Proficient in social engineering, phishing, and related fraud schemes.
- Strong general knowledge of security concepts and expertise in network and web application security issues.
- Experience with a scripting language such as Python, Bash, PowerShell, or other scripting language in an incident handling environment.
