Security Operations Lead, Square Enix

• The role is aimed at candidates with a broad and senior Cyber Security skillset who are seeking to further develop their Cyber Security career in an exciting industry. Engineering skills in maintaining Security Information and Event Management (SIEM) platforms and the configuration of our wider security tools are key
• We are also seeking candidates with experience leveraging AI to enhance productivity and effectiveness

Desirable

• The Security Operations Lead is responsible for our security monitoring and incident response capabilities within the Square Enix Cyber Security team (covering Europe and North America)
• The primary goals of the role are the timely detection of security incidents, effective response and the continuous improvement of our preventative and detective controls
• This role will work alongside our team of security analysts and engineers to collectively protect our players, people and assets whilst enabling creativity and innovation across Square Enix
• Day to day you will be performing in-depth analysis and investigation of security alerts, game/brand related security events as well as leading the response to incidents
• You will be responsible for maintaining and optimising our security operations tools and processes
• Additionally you will be testing the effectiveness of our preventative and detective controls, probing weaknesses and implementing improvements alongside our risk and engineering teams
• Leading investigation and analysis of security alerts to identify and promptly respond to security events
• Leading the response to major cyber security incidents, collaborating with key business and technical stakeholders during investigations to gather further information and coordinate response actions
• Identifying and responding to game related threats like leaks, cheats, piracy, copyright abuse and account compromise
• Managing our security operations outsourcing partners to maximise the value and quality of their service delivery
• Maintaining a broad understanding of IT/online environments and key company assets to enhance decision making and response to incidents
• Maintaining and optimising our Cyber Security tools and platforms to continuously improve our detection and response capability
• Supporting the management, administration and support of our SIEM platform, including general infrastructure and system administration, troubleshooting and user access management
• Maintaining and tuning security detections and alerts within our SIEM platform
• Onboarding and managing security log sources for our SIEM platform, including agent and policy deployment, creation and maintenance of ingest pipelines and index template and pattern creation
• Guiding and mentoring the day to day work of our Security Analysts, providing expertise to support their task and project delivery
• Collaborating with risk and architecture teams to continuously test and refine our security controls through attack simulation and purple team operations
• Influencing the strategic direction and priorities of our Cyber Security team by presenting insight into the security events, alerts and incidents we handle
• Continuously improving our security operations processes, escalation paths and playbooks
• Leveraging AI capabilities to enhance the effectiveness of our security capabilities and your own productivity in the role
• Consuming relevant threat intelligence to drive proactive action within the Cyber Security and wider IT environment
• Indicative Performance Measures:
• Mean time for business recovery to C1 (Highest criticality) level security incidents
• Security event triage time
• Game/brand leak detection timeframes
• High availability of security tools
• Security maturity improvements