Senior Cyber investigator in Miami, FL at Royal Caribbean Group

Journey with us! Combine your career goals and sense of adventure by joining our exciting team of employees. Royal Caribbean Cruises Ltd. is pleased to offer a competitive compensation & benefits package, and excellent career development opportunities, each offering unique ways to explore the world.

Position Summary:

The Senior Cyber Investigator role combines the responder, computer forensics, threat analysis, behavioral & analytics functions  to become a technology subject matter expert. This role will consult with RCL business groups, external researchers, local, Federal and international law enforcement. Within the RCL Incident Management Program the senior investigator will perform cyber investigations for the RCL enterprise including those relating to external hackers, insider abuse and fraud. The Investigator will assist with developing and deploying the enterprise incident response and threat analysis program and supporting documentation, participating in operational analysis, and leading investigations of actual or potential cyber incidents. The role requires the first responder to be proactive and a highly technical subject matter expert in security, technologies, threat analysis and indicators of compromise.

The Investigator will collaborate their efforts with Information Security (IS) senior and executive leadership as well as key personnel within Information Technology (IT), Legal, Crisis Management, Compliance and Ethics, Human Resources, Global Security, Internal Audit, Privacy and Global Business Management. This collaboration helps ensure the Cyber Threat program is evaluating and managing threats in all external information sharing relationships. The Investigator needs to understand forensic tools, develop SIEM queries and dashboards, develop and implement analytical models, review threat intelligence data and work understand and work with SOAR technologies. The role requires sound judgment with a high level of integrity, ethics and ability to calmly, diplomatically and effectively deal with stressful situations

Essential Duties and Responsibilities:

• Computer Forensics (4 - 8 years)
  • Follows applicable laws and regulations, standards and policies to conduct computer forensics procedures and investigation practices.
  • Collects and analyzes information data (system logs, network traffic activity, encrypted or erased data, etc.) of IT systems, networks, hardware/software and suspected devices.
  • Prepares incident investigation reports and documents of computer forensics for following processing.
  • Uses techniques and tool sets (e.g. Encase, X-Ways, FTK, SIFT) to detect and track electronic data trails and digital evidence of information security incidents.
  • Works with computer forensics measures to detect information security incidents, such as cybercrimes, hacking, intrusions, and frauds
• Digital Forensic Tools (4 - 8 years)
  • Works with basic function of digital forensics tools.
  • Monitors forensics procedures and adjusts digital forensics tools accordingly.
  • Explains forensics results from a business development perspective.
  • Compares the uses and benefits of diverse digital forensics tools.
  • Selects a digital forensics tool for a specific case while minimizing risk.
• Information Security Technologies      (4 - 8 years)
  • Installs, upgrades or maintains firewall technology or anti-virus software.
  • Explains computer forensics, authentication mechanisms and digital certificates.
  • Participates in evaluating information security features against business requirements.
  • Utilizes a specific hardware or software security technology to control risks.
  • Collects and documents information about new information security tools.
• Intrusion Detection and Prevention     (4 - 8 years)
  • Utilizes intrusion detection and prevention technologies, systems and tools to monitor, analyze and respond to networks and systems.
  • Assists in the implementation of intrusion detection and prevention systems.
  • Reviews and records IDS and IPS system logs; analyzes alarms of abnormal events.
  • Tests and tunes the performance of IDS and IPS regularly.
  • Works with basic functions and operations of intrusion detection and prevention.
• Incident Response and Investigations  (4 - 8 years)
  • Able to identify gaps in IR process and runbooks, make suggestions for improvements
  • Able to complete IR investigations without supervision
  • Take a senior role in tabletop exercise
  • Lead parts of major cyber incidents
  • Fulfill the role of scribe of major cyber incidents
  • Demonstrates creative thinking and the ability to solve issues
  • Identifies gaps in technologies and tools for incident response related investigations and socializes within the IR team
  • Identifies complex computer crime evidence in legal proceedings.
  • collaborates with senior management on risk management and computer security.
• Digital Threat Management (4 - 8 years)
  • Performs basic tasks associate with digital threat detection and analysis, such as intrusion detection.
  • Conducts the real-time gathering and assessment of digital threats information.
  • Assists in the system scan to identify potential vulnerabilities.
  • Monitors the operation of organizational network to ensure compliance
• Work Environment:
  • 80% of work is done in main office
  • 10% of work is done shipboard
  • 10% of work requires domestic or international travel
  • On-Call rotation