Address
SalaryAt Disney, we’re storytellers. We make the impossible, possible. The Walt Disney Company is a world-class entertainment and technological leader. Walt’s passion was to continuously envision new ways to move audiences around the world—a passion that remains our touchstone in an enterprise that stretches from theme parks, resorts and a cruise line to sports, news, movies, and a variety of other businesses. Uniting each endeavor is a commitment to creating and delivering unforgettable experiences — and we’re constantly looking for new ways to enhance and protect these exciting experiences.
The Attractions Operational Technology (AOT) Cybersecurity team provides services and solutions to secure and enhance the reliability of the computer and control networks on which the rides and shows run in our theme parks. This is done through risk evaluation, collaboration, standardization, enforcement, and education across the business segment. Our team has efforts engaged in both the new themed attractions as well as our legacy attractions. Our processes are divided amongst design and architecture, monitoring and logging, and vulnerability management.
We are looking for a team member with a passion for security in an operational technology setting. The successful candidate will demonstrate a friendly, collaborative approach to applying their skills – both through requesting and offering feedback to the team members that surround them.
The AOT Cybersecurity team partners with many other divisions to design, build and integrate cybersecurity solutions that proactively protect Disney assets, systems, data, and guests in our parks.
What You Will Do:
The Cyber Tech Spec – SOC Analyst is a key team member dealing with security operations. This involves methodically working through alerts generated and received by the team’s tools integrated into the attraction networks. You will:
- Consistent monitoring of the attractions network, security, and application logs using the SIEM.
- Investigate and resolve perceiving threats, incidents, and warnings.
- Participate in a feedback loop involving alert receipt, processing, and tuning.
- Work with the broader team to build fixes which eliminate perceived threats or vulnerabilities.
- Collaborate with other departments to implement procedures, methods, and best practices.
- Perform threat hunting activities across the many tools available.
- Manage EDR deployment including building profiles and packages for distribution.
- Reduce downtime and ensure business continuity.
- Participate in periodic compliance audits by assisting with preparing and evaluating data.
- Receive guidance from senior team members related to best practice methods and techniques.
- Stay updated about latest security threats.
Required Qualifications& Skills:
- Minimum of 3 years of related work experience.
- Strong analytical skills: ability to analyze, interpret, recommend, and communicate threats.
- Understanding of networking technology including familiarity with OSI stack and associated host identifiers (MAC, IP, etc).
- Ability to perform log analysis and basic forensic evidence collection for Windows operating systems.
- Familiarity with the role of the SIEM and the SOAR in a cybersecurity team.
- Familiar with SQL, Python or Powershell programming languages.
- Passion for threat research and continuous growth of one’s own analytical techniques.
- Ability to multi-task, manage, and prioritize one’s own time.
- Ability to develop strong and effective working relationships.
Education:
- Bachelor’s degree in Computer Science, Information Systems, Software, Electrical or Electronics Engineering, or comparable field of study, and/or equivalent work experience
Preferred Qualifications:
- SIEM/SOAR experience
- Possess and of the following certifications: Security+, CySA+, SSCP, GSEC, or similar cybersecurity certification.
- Experience building, analyzing, or supporting information systems in an Operational Technology environment (utility, manufacturing, transportation, medical, or themed entertainment).
- Experience analyzing alerts in Endpoint Detection and Response (EDR) products such as Crowdstrike, Trendmicro, McAfee, Symantec, Cisco AMP, Palo Alto Cortex or similar tools.
