安全运营分析师
安全运营分析师监视、调查和应对针对组织系统和数据的网络安全威胁。他们对安全监控工具的警报进行分诊，调查可疑活动，遏制事件，并帮助修复弱点。在医疗卫生领域，快速发现和响应能保护临床服务和保密的患者信息免受勒索软件等攻击。
本文由人工智能助手从英文翻译而来，尚未经过母语人士审校。引自英国政府数字与数据专业能力框架（UK GDaD PCF）和 ESCO 的内容保留英文原文。
- 职族
- 网络安全
- UK GDaD PCF 角色
- 无：本参考资料定义该角色
- ESCO 职业
- cyber incident responder (ISCO-08 2529); ICT security technician (ISCO-08 3512)
级别
| 职级 | 角色级别 | UK GDaD PCF 级别 | 英国公务员职等 | 岗位评估分数 |
|---|---|---|---|---|
| 5 | 初级安全运营分析师 | — | — | 348 |
| 6 | 安全运营分析师 | — | — | 440 |
| 7 | 高级安全运营分析师 | — | — | 496 |
在数字医疗卫生组织中
- 医疗卫生经常成为勒索软件和数据窃取的目标，一次攻击就可能使全组织的临床系统停止运行。
- 隔离服务器或部分网络等遏制决定必须权衡安全风险与对患者照护的影响，因此分析师与临床和运营负责人合作。
- 网络中包括无法运行安全代理或无法快速打补丁的医疗器械和遗留系统，因此分析师依靠网络监控和补偿性控制措施。
- 监控涵盖对患者记录的访问，因此分析师与信息治理部门合作，既帮助发现外部攻击，也帮助发现内部人员的不当访问。
- 安全监控全天候运行，因此分析师可能轮班或参加值班轮换。
ESCO 职业与技能
ESCO 列出了雇主对每种职业通常需要（必备）或可能需要（可选）的技能和知识。可将其用作发展谈话的检查清单。
cyber incident responder
Cyber incident responders monitor and assess cybersecurity state systems, analysing, evaluating, and mitigating the impact of cybersecurity incidents. Moreover, they identify malicious actors and cyber incidents root causes. According to the organisation’s Incident Response Plan, they restore systems and process functionalities to an operational state, collecting evidence and documenting actions taken.
必备技能和知识（23）
技能与能力
- collect cyber defence data
- communicate with stakeholders
- create incident reports
- engage with stakeholders
- handle cybersecurity incidents
- protect ICT devices
- provide ICT consulting advice
知识
- GDPR
- ICT network security risks
- ICT security legislation
- ICT security standards
- attack vectors
- building systems monitoring technology
- cyber attack counter-measures
- cyber security
- ethical hacking principles
- incidents and accidents recording
- operating systems
- operational tactics for emergency responses
- risk management
- security engineering
- security threats
其他
可选技能和知识（52）
技能与能力
- consult with business clients
- create project specifications
- define quality standards
- develop information security strategy
- ensure information security
- ensure proper document management
- give live presentation
- implement ICT risk management
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement spam protection
- lead disaster recovery exercises
- manage ICT change request process
- manage IT security compliances
- manage a team
- manage changes in ICT system
- manage digital identity
- manage keys for data protection
- monitor system performance
- optimise choice of ICT solution
- perform project management
- perform risk analysis
- perform scientific research
- protect personal data and privacy
- provide information
- provide user documentation
- remove computer virus or malware from a computer
- track key performance indicators
- troubleshoot
知识
- C++
- ICT encryption
- ICT process quality models
- ICT project management methodologies
- Internet of Things
- Process-based management
- Python (computer programming)
- business intelligence
- cloud monitoring and reporting
- cloud security and compliance
- cloud technologies
- copyright legislation
- defence standard procedures
- embedded systems
- information security strategy
- internet governance
- leadership principles
- lean project management
- project management
- safety engineering
- web application security threats
ICT security technician
ICT security technicians propose and implement necessary security updates and measures whenever is required. They advise, support, inform and provide training and security awareness.
必备技能和知识（34）
技能与能力
- address problems critically
- analyse ICT system
- communicate with stakeholders
- engage with stakeholders
- ensure proper document management
- establish an ICT security prevention plan
- estimate duration of work
- execute software tests
- identify ICT security risks
- identify ICT system weaknesses
- implement ICT risk management
- integrate system components
- manage alarm system
- manage closed-circuit television system
- manage system security
- protect ICT devices
- set up cybersecurity training programmes
- solve ICT system problems
- use access control software
知识
- ICT networking hardware
- ICT security standards
- ICT system programming
- attack vectors
- audit techniques
- cyber attack counter-measures
- cyber security
- levels of software testing
- operating systems
- penetration testing tool
- procurement of ICT network equipment
- security engineering
- systems development life-cycle
- tools for ICT test automation
- web application security threats
可选技能和知识（61）
技能与能力
- comply with legal regulations
- cooperate with colleagues
- execute ICT audits
- implement ICT security policies
- implement a firewall
- implement a virtual private network
- implement anti-virus software
- implement cloud security and compliance
- install low voltage wiring
- manage IT security compliances
- manage cloud data and storage
- manage keys for data protection
- remove computer virus or malware from a computer
- use back-up and recovery tools
知识
- ABAP
- AJAX
- APL
- ASP.NET
- Assembly (computer programming)
- C#
- C++
- COBOL
- Cisco
- CoffeeScript
- Common Lisp
- Erlang
- Groovy
- Haskell
- ICT encryption
- ICT network security risks
- ICT security legislation
- Internet of Things
- Java (computer programming)
- JavaScript
- Lisp
- MATLAB
- ML (computer programming)
- Microsoft Visual C++
- Objective-C
- OpenEdge Advanced Business Language
- PHP
- Pascal (computer programming)
- Perl
- Prolog (computer programming)
- Python (computer programming)
- R
- Ruby (computer programming)
- SAP R3
- SAS language
- Scala
- Scratch (computer programming)
- Smalltalk (computer programming)
- Swift (computer programming)
- TypeScript
- VBScript
- Visual Basic
- cloud monitoring and reporting
- cloud security and compliance
- computer programming
- organisational resilience
其他
Contains ESCO v1.2.1 data (https://esco.ec.europa.eu/). © European Union. Reuse authorised under Commission Decision 2011/833/EU.