Threat and Vulnerabilities Analyst – CERT NZ

Tēnei tūranga – About the role

A CERT is an organisation that receives cyber incident reports, tracks cyber security incidents, or attacks, and provides advice and alerts to its customers on how to respond and prevent further attacks. CERTs also work closely with their international counterparts to prevent and respond to cybersecurity incidents and address cybercrime.

Establishing a national CERT means New Zealand joins an international network of CERTs, improving our access to information on potential or real-time cyber-attacks. It will help New Zealand play our part in a global effort to improve internet security. Ultimately, New Zealand will become a more trusted business and security partner

CERT NZ is staffed with passionate cyber security experts and experienced staff, providing services Monday to Friday, except when activated by the national emergency response system when staff may be required to work weekends and/or outside normal hours.

The Threat and Vulnerabilities Analyst is responsible for collecting, monitoring, and analysing, active as well as potential cyber security threats, while gathering useful cyber intelligence from a wide range of sources. This role will be pivotal in centralizing, organizing, and prioritizing, all threat and vulnerability information gather by CERT NZ and presenting relevant, notable threats through reporting.

Ngā herenga – Requirements of the role

Personal specifications

• Good understanding of cyber threat attack vectors, how they are used, and methods to detect and mitigate them.
• Good understanding of how cyber-attacks are executed at a technical level.
• Strong analysis skills and the ability to bring complex data together to answer security and risk related questions.
• Proficient in high quality report writing for technical and non-technical audiences.
• Thorough understanding of cybersecurity principles.
• Good presentation skills and experience distilling complex security topics into concise and relevant material for both security and non-security professionals.
• Must be a NZ citizen or hold a residence class visa.
• Able to gain and maintain a national security clearance as required.

Qualifications

• A tertiary qualification, preferably in a technical discipline (e.g., System Engineering, Computer Science, Criminology, Cyber Security) and/or comparable relevant business experience.

Takohanga tuhinga o mua – Key accountabilities and deliverables

Threat and Vulnerabilities

• Maintain, organise and source commertial and non commertial CERT NZ cyber threat intelligence feeds.
• Analyse, prioritise and report on relevant threat and vulnerabilities affecting the New Zealand Landscape.
• Collaborate with CERT NZ teams to centralise and share relevant information or intelligence.
• Keep CERT NZ teams and leadership informed on critical threats and vulnerabilities relevant to New Zealand.
• Work closely with Threat & Vulnerabilities Advisor and CERT NZ incident response team to prioirtise information collection and reporting.
• Produce high quality threat and vulnerability dashboards, content and reports cyclicaly as required.
• Maintain awareness of the global threat landscape and review complex, technical threat data, to produce CERT NZ cyber intelligence products and services.
• Aid in investigations, information and intelligence sourcing as required.
• Creates Ad-hoc threat and vulnerabilities reports for one-off requirements.
• Assists with administration, maintenance, and enhancement of the reporting infrastructure to enable high value, relevant, informative reporting in a timely manner.

Stakeholder management

• Preparing and participating in sector briefings and interactions with the cyber security community.
• Initiating and maintaining effective relationships with key infosec teams across New Zealand to inform, shape and collaborate on work related to cyber security.
• Proactively establishing and maintaining effective working relationships with key stakeholders including other functional leaders. Actively building and managing a network of stakeholders to inform and build the role’s work.
• Leveraging relationships to identify and share best practice information.

Cyber security – knowledge and incident response

• Develops a level of expertise and fluency in the cyber security field, including staying up to date with new developments and relevant international activity.
• Finds opportunities to share cyber security domain knowledge with others within the team and wider CERT NZ.
• Develops and builds skills and knowledge to participate in serious cyber incident response and coordination, including, where appropriate:
  • Contributing to the unit’s response, thereby being instrumental in the coordination of New Zealand’s overall response to serious cyber incidents.
  • Conducting and supporting briefings to senior executives.
  • Communicating with technical and non-technical audiences.
• Able to participate in shift-based periods during activation for New Zealand’s response to serious cyber incidents.

Wellbeing, health & safety

• Displays commitment through actively supporting all safety and wellbeing initiatives
• Ensures own and others safety at all times
• Complies with relevant safety and wellbeing policies, procedures, safe systems of work and event reporting
• Reports all incidents/accidents, including near misses in a timely fashion
• Is involved in health and safety through participation and consultation

Tō tūranga i roto i te Manatū – Your place in the Ministry

The Threat & Vulnerabilities Analyst position reports into the Manager Insights and Reporting within CERT NZ that sits within the Strategy and Enablement branch. The branch sits within the Te Whakatairanga Service Delivery group.

More information about MBIE's structure

To mātou aronga – What we do for Aotearoa New Zealand

Hīkina Whakatutuki is the te reo Māori name for the Ministry of Business, Innovation and Employment. Hīkina means to uplift. Whakatutuki means to move forward, to make successful. Our name speaks to our purpose, Grow Aotearoa New Zealand for All.

To Grow Aotearoa New Zealand for All, we put people at the heart of our mahi. Based on the principles of Te Tiriti o Waitangi / The Treaty of Waitangi, we are committed to upholding authentic partnerships with Māori.

As agile public service leaders, we use our breadth and experience to navigate the ever-changing world. We are service providers, policy makers, investors and regulators. We engage with diverse communities, businesses and regions. Our work touches on the daily lives of New Zealanders. We grow opportunities (Puāwai), guard and protect (Kaihāpai) and innovate and navigate towards a better future (Auaha).

Ngā matatau – Our competencies

Cultivates innovation We create new and better ways for the organisation to be successful by challenging the status quo generating new and creative ideas and translating them into workable solutions.

Nimble learning We are curious and actively learn through experimentation when tackling new problems by learning as we go when facing new situations and challenges.

Customer focus We build strong customer relationships and deliver customer-centric solutions by listening and gaining insights into the needs of the communities we serve and actively seeking and responding to feedback.

Decision quality We make quality and timely decisions that shape the future for our communities and keep the organisation moving forward by relying on an appropriate mix of analysis, wisdom, experience, and judgement to make valid and reliable decisions.

Action oriented We step up, taking on new opportunities and tough challenges with purpose, urgency and discipline by taking responsibility, ownership and action on challenges, and being accountable for the results.

Collaborates We connect, working together to build partnerships with our communities, working collaboratively to meet shared objectives by gaining trust and support of others; actively seeking the views, experiences, and opinions of others and by working co-operatively with others across MBIE, the public sector and external stakeholder groups.

Te Tiriti o Waitangi

As an agency of the public service, MBIE has a responsibility to contribute to the Crown meeting its obligations under Te Tiriti o Waitangi (Te Tiriti). Meeting our commitment to Te Tiriti will contribute towards us realising the overall aims of Te Ara Amiorangi – Our Path, Our Direction, and achieve the outcome of Growing New Zealand for All. The principles of Te Tiriti - including partnership, good faith, and active protection – are at the core of our work. MBIE is committed to delivering on our obligations as a Treaty partner with authenticity and integrity and to enable Māori interests. We are committed to ensuring that MBIE is well placed to meet our obligations under the Public Service Act 2020 (Te Ao Tūmatanui) to support the Crown in strengthening the Māori/Crown Relationship under the Treaty and to build MBIE’s capability, capacity and cultural intelligence to deliver this.

Mahi i roto i te Ratonga Tūmatanui – Working in the public service

Ka mahitahi mātou o te ratonga tūmatanui kia hei painga mō ngā tāngata o Aotearoa i āianei, ā, hei ngā rā ki tua hoki. He kawenga tino whaitake tā mātou hei tautoko i te Karauna i runga i āna hononga ki a ngāi Māori i raro i te Tiriti o Waitangi. Ka tautoko mātou i te kāwanatanga manapori. Ka whakakotahingia mātou e te wairua whakarato ki ō mātou hapori, ā, e arahina ana mātou e ngā mātāpono me ngā tikanga matua o te ratonga tūmatanui i roto i ā mātou mahi.

In the public service we work collectively to make a meaningful difference for New Zealanders now and in the future. We have an important role in supporting the Crown in its relationships with Māori under the Treaty of Waitangi. We support democratic government. We are unified by a spirit of service to our communities and guided by the core principles and values of the public service in our work.

What does it mean to work in Aotearoa New Zealand’s Public Service?(external link) — Te Kawa Mataaho The Public Service Commission