Lead Engineer - Phishing Analysis (Cyber Security Office)

Position Overview

We are seeking an experienced Cybersecurity Analyst with proven expertise in investigating Phishing incidents and/or cybersecurity incidents, to lead the Phishing analysis team.

The Phishing campaign lead will identify and neutralise email phishing campaigns against Public Healthcare. Besides triaging suspected phishing activity, performing detailed analysis of phishing emails and related indicators, and coordinating rapid incident response to contain active campaigns, the Phishing campaign lead will guide the team to analyse email gateway metadata at scale. He/she will review gaps in existing controls/security solutions to identify improvements to strengthen Public Healthcare defences against future phishing campaigns, while supporting stakeholders to strengthen phishing awareness programs across the organization.

Role & Responsibilities

• Analyse phishing emails by investigating the email headers and body, including attachments and URLs.
• Analyse email gateway metadata at scale to identify possible phishing email campaigns, and assess the level of threat for each. 
• Identify tactics, techniques, and procedures (TTPs) used in isolated incidents, targeted, as well as widespread phishing campaigns, and recommend short-term mitigations to neutralise phishing campaigns. 
• Analyse how phishing emails slip past email security solutions, capabilities gaps, and explore longer-term enhancements of email security solutions.
• Maintain detection rules, improve filtering effectiveness, and contribute to automation of phishing response workflows. 
• Coordinate with incident response and threat intelligence teams during phishing investigations to assess impact of phishing attacks, identify affected users, and trace attacker infrastructure. 
• Analyze phishing trends, uncover attacker patterns, and link related phishing activity to broader threat campaigns.
• Develop new methods of identifying phishing/malicious content using existing tools, or by building new capabilities.
• Prepare clear and detailed phishing incident reports, threat advisories, and reports on trends observed from email phishing campaigns conducted against public healthcare.
• Stay current on phishing tactics targeting the healthcare sector and emerging threat actor behaviors.
• Support and enhance phishing simulations and user training efforts to reduce organizational risk  

Requirements

• At least 8 years of cybersecurity experience, with hands-on involvement in incident investigations, phishing analysis, or threat intelligence operations.
• Demonstrated experience investigating phishing campaigns—including large-scale or organization-wide attacks.  
• Familiarity with email security tools and email protocols, phishing indicators, and social engineering tactics  
• Proficiency in programming and scripting (using Python, Java, Ruby etc.) is required, automation experience is preferred.
• Proficiency in use of SIEM/SOAR security monitoring platforms
• Strong critical thinking, pattern recognition, and analysis skills  
• Ability to communicate complex technical findings to both technical and non-technical audiences

Apply Now

NOTE: It only takes a few minutes to apply for a meaningful career in HealthTech - GO FOR IT!!