Position Description. NZSIS SIEM Team Leader. Branch/Directorate: Responsible to: Position purpose: Direct reports: Financial delegation:

Transcription

1 Position Description NZSIS SIEM Team Leader Branch/Directorate: Responsible to: Position purpose: Direct reports: Financial delegation: Directorate overview: Protective Security Enhancement (PSE) Directorate Counter Intelligence Section Manager The Security Information Event Management (SIEM) Team Leader is responsible for managing the day-to-day operations of the SIEM unit. The SIEM unit is responsible for log data collection and analysis enterprise monitoring for anomalous behaviour and providing evidence to aid investigations. This role requires a high level of trust, personal integrity and discretion. Up to 10 direct reports Nil The PSE Directorate delivers a full range of protective security functions to the NZIC and for New Zealand. The PSE Directorate leads the implementation of the Protective Security Requirements (PSR) programme, which aims to substantially improve the security culture of the public service and, potentially, the private sector. The PSE Directorate is also responsible for protecting the integrity of the public service and NZIC through effective security clearance management, vetting services and counter intelligence functions. Led by the PSE Directorate, the NZIC will be an exemplar of physical, IT and personnel security best practice. PAGE 1

2 Branch overview: Remuneration indicator: TBA H Date evaluated: July 2016 NZSIS mission and values Our mission Keeping New Zealand and New Zealanders safe and secure. Our values Courageous, Self-aware, Driven, Collaborative, Positive Protective Security Enhancement Directorate Purpose Leading Protective Security advice and assurance for New Zealand Functional relationships External contacts: New Zealand Intelligence Community (NZIC) counterparts, stakeholders and customers Internal contacts: All staff and managers of the NZSIS NZ government stakeholders and customers Objectives The position of SIEM Team Leader encompasses the following major functions or objectives: Providing oversight of the SIEM function, ensuring the team is collecting and analysing logs appropriately for the NZIC and other relevant government agencies for the detection of anomalous behaviour Managing the day-to-day activities of the SIEM team to ensure organisational objectives are met The requirements in the above objectives are broadly identified below: Jobholder is accountable for: Jobholder is successful when: PAGE 2

3 Leadership, management and service delivery Relationship Management/ Customer Engagement Provide leadership and management to the SIEM unit, including business planning, prioritisation, managing workflows, and advising on the SIEM Operating Budget. Manage service availability, capacity planning, operating policies and procedures. Deliver agreed objectives against plans. Staff managed and supported through individual plans. Regular review with staff, including seconded staff, to discuss performance and development. Develop, manage and maintain key relationships across the NZIC and subscribing agencies. Professionally represent the SIEM unit, leading discussions with internal and external partners, customer and stakeholders. Develop and manage day-to-day relationships with internal stakeholders. Liaise with NZIC and international partner capabilities; where necessary, represent New Zealand at international events. Analysis and reporting Lead security data analysis to aid in the detection of anomalous behaviour. Ensure the ongoing development of the SIEM analysis and reporting. Work with line management to develop and implement a reporting framework, ensuring metrics and measures are defined, collected, analysed and reported to relevant stakeholders to an agreed schedule. Ensures business continuity and event handling processes are established and validated. Ensure alignment with internal, national and international standards and guidelines. Lead and manage the ongoing quality assurance process associated with all PAGE 3

4 threat assessments and reports prepared to ensure SIEM achieves a high level of credibility among both customers and contributors. Audit and compliance Work with IT security to ensure change management processes are established and effective. Work with IT security to ensure accreditation of SIEM networks and systems are achieved and maintained. Advice and guidance Lead on-going development and fine tuning of analytical capability Provide recommendations on improving enterprise, information and personnel security to relevant stakeholders. Provide direction in the collection of log data. Implement a programme of continuous process improvement. Precise performance measures for this position will be developed in discussion between the jobholder and manager as part of the performance development process. It is also expected that you will undertake other duties that can be reasonably be regarded as relevant to the position, your experience and capability. Person specification Qualifications Essential: Tertiary level qualification (Bachelor level) or equivalent experience in Information Technology, Computer Science or equivalent, with an emphasis on information security. Desirable: At least five year experience in IT security, security or policy management role. Proven experience with log analysis tools Knowledge/experience Essential: Proven ability to develop and lead high performing teams Experience in collaborating with and Desirable: Proven analytical experience with auditing and log analysis Experience in defining and PAGE 4

5 influencing others to achieve results Demonstrated high levels of integrity and an ability to obtain and maintain a TSS security clearance implementing policy, and managing or auditing security or IT systems Risk management experience Experience in project management activities where the co-ordination of others to deliver outcomes requires persuasion and relationship management skills Working understanding of the intelligence sector Personal attributes Results oriented with a demonstrable commitment to perform. Thinks critically and logically. Excellent communication and interpersonal skills. The ability to be self-motivated, flexible and a team player. An ability and desire to learn new and sometimes complex skills. Demonstrate sound judgment, tact and integrity in dealing with sensitive issues. Core competencies All employees are measured against the following core competencies as part of performance development and review: Promotes a Security Culture Shapes Strategic Thinking Achieves results Cultivates Productive Working Relationships Exemplifies Personal Drive and Integrity Communicates with Influence Changes to position description Positions in the NZSIS may change over time as the organisations develop. Therefore, we are committed to maintaining a flexible organisation structure, which best enables us to meet changing market and customer needs. Responsibilities for this position may change over time as the job evolves. Such change may be initiated as necessary by the manager of this position. This position description may be reviewed as part of the preparation for performance planning for the annual performance cycle. PAGE 5

6 Health and safety NZSIS is committed to providing a healthy and safe work environment and safe management practices for all employees. Employees are expected to share this commitment as outlined in the Health and Safety in Employment Act by taking all practicable steps to ensure:- a. The employee s safety while at work, and b. That no action or inaction of the employee while at work causes harm to any other person. Knowledge management Employees are responsible for ensuring that all business records created are accessible and stored in the correct manner according to NZSIS record keeping policy, standards, and procedures. Employee: Date: Manager: Date: PAGE 6