Incident Response Analyst

The Organization and Role
About Access Now
Access Now defends and extends the digital rights of people and communities at risk. As a grassroots-to-global organization, we partner with local actors to bring a human rights agenda to the use, development, and governance of digital technologies, and to intervene where technologies adversely impact our human rights. By combining direct technical support, strategic advocacy, grassroots grantmaking, and convenings such as RightsCon, we fight for human rights in the digital age.
About this role
The Incident Response Analyst helps to manage the incident response efforts of the global, Access Now Helpline team. The Incident Response Analyst works closely with the Helpline regional team of incident handlers to analyze threats, and to escalate cases as needed. The Analyst helps to build and strengthen the Helpline’s capacity to respond to digital security incidents affecting Access Now’s constituency.
The Incident Response Analyst works closely with the Helpline Team, and reports through the Helpline’s Incident Response Manager.
What you will do
Support management of digital security incidents, such as instances of account compromise, malware, phishing and data leak, by serving as a 2nd level incident responder (Tier 2)
Support the team of incident handlers in conducting information security incident root cause analyses
Analyze and gain understanding of artifacts related to incidents managed by the Helpline, taking into consideration the need to preserve forensic evidence
Gather and correlate incident data to identify specific vulnerabilities and make recommendations that enable preparation and remediation both in individual cases and in response to trends affecting larger communities
Continuously learn about tools, techniques and tactics used by adversaries and the techniques used to defend against them
Serve as second level escalation point for the Incident Handling team on technical escalations related to incident response, providing guidance proactively or in reply to incident handlers (Tier 1) escalations requests
Strengthen the Helpline’s ability to produce and share quality threat intelligence indicators and trends, including by reviewing MISP events, supporting the development of public or confidential security advisories to inform constituents of the current situational picture and how it may be changing
Support the development of workflows and processes to increase the Helpline’s ability to consume threat information and feeds, including by following threat intelligence work done by other organizations and groups to better inform the Helpline’s work and protect it’s beneficiaries
Provide expertise to other security experts, CSIRTs, and CSIRT communities from Civil Society, including within CiviCERT, in order to help prevent and mitigate digital security incidents
Support the Helpline efforts to develop the skills and expertise of incident handlers (tier 1), including by supporting onboarding efforts and relevant internal working groups
Assist in global implementation of the annual RightsCon summit series
Perform other duties as assigned
Skills, education, and mindset you will bring
Demonstrated experience working in incident response or customer support escalation teams
Core technical competency, informally or formally
Prior experience working with, or interest in supporting women and/or queer communities, civil society, and human rights defender organizations in the region
Familiarity with anonymity and circumvention tools, security technologies, and risk assessment frameworks
Familiarity with: Snort or Bro IDS; Cisco networking; Apache; Firewalls; Tails; GPG encrypted email; malware analysis; web development; Perl; C; PHP; Javascript; Wireshark; MySQL; Wifi; TCP/IP; SMTP; HTTP/S; TLS; PKI; VPN; VM; or SSH
Skills in gender analysis and awareness
Strong cultural understanding and experience across the region
Interest in training and user education
Excellent English written and verbal communication skills
Fluency in other languages beside English
Appropriate education and work preparation for the role, with bachelor or master degree equivalent in computer science (or similar) preferred
The Details
Location
This is a full-time position, with preference for Philippines, Indonesia and India. The successful candidate must possess the right to work in the location in which they will be based. At this time, most Access Now Team Members are working through hybrid office arrangements, combining remote at-home work with intermittent use of offices and/or co-working spaces.
Remuneration
Access Now offers competitive compensation and benefits packages that align competitively with locations and regions around the world. Location-specific examples of initial placement within the salary range for this role include:
₱100,478.17 gross monthly (Philippines)
Rp40,500,000.00 gross monthly (Indonesia)
₹163,200.00 gross monthly (India)
Benefits for this specific role are tied to the location, and will vary. Regardless of location, all Team Members benefit from a strong global culture aligned around:
Work-life balance...including a generous paid time-off program between 36 and 40 days annually
Access to supplemental health care insurance policies
Professional development and growth opportunities
Extensive workplace flexibility
Organizational resilience and support for all team members, including paid family leave and employee assistance programs
Connection to a diverse, global team of passionate, principled professionals

Employment type
Full-Time basis

Work arrangement
Yes