About this role
Job Description Experience:
• 2 - 4 years of experience in Security Operation Center (SOC), Cyber Security, and Information Security within an enterprise environment. • Experience with Windows and Linux, server and application hardening process. • Experience supporting one or more information security technologies. • Mandatory experience in Azure, EDR, XDR (Crowdstrike, Windows Defender), SOAR, SIEM Tools (e.g., Splunk, Rapid7, ArcSight, McAfee Nitro), Palo Alto, Cisco and one of the following: IDS/IPS, database activity monitoring, multi-factor authentication, web content filtering, encryption, and encryption key management, DLP, change detection. • Working knowledge of TCP/IP stack & familiarity with common protocols e.g., HTTP, FTP, SMTP, DNS. • Familiarity with network and application threats such as DoS/DDoS, SQL injection, XSS, reconnaissance scanning, and methods to avoid detection. • Working knowledge of compliance, and regulatory requirements, such as Payment Card Industry (PCI), Sarbanes-Oxley (SOX), and Healthcare Information Privacy Protection Act (HIPAA). • Experience with vulnerability scanning tools such as Nessus, Acunetix, Qualys, or Metasploit a plus. • Have scripting experience with Bash, PowerShell, or Python and the ability to use these skills to aid in responding to incidents involving Windows, Linux, and Mac hosts. • Be familiar with the MITRE ATT&CK Framework and/or Cyber Kill Chain. • InfoSec certification are a plus such as CISSP, CompTIA Security+, GIAC Security Essentials, & CEH • Have strong oral and written communication skills Strong interpersonal and leadership skills. Responsibilities:
• Triage security incidents identified by SOC analysts. • Identify enhancement to rule sets and other tool optimization to automate reporting and reduce false positives in unified SIEM and review with manager / senior team members for implementation. • Coordinate with SOC manager to escalate security issues to other business units including solutions development, customer hosting and corporate IT. • Collaborate with business units to prioritize vulnerability remediation and execution of planned activities. • Subscribe to threat intelligence services and monitor vendor alerts for major vulnerability disclosures. • Monitoring of advanced security tools, perform analysis of dissimilar indicators, correlation of multiple sources, alert & coordination of security incidents across the environment. • Review & analyze system logs and third-party management products to preemptively detect, take defined corrective actions and alert process/system owners to new issues. • Assist with creation and maintenance of security incident response procedures. • Participate in research and assist implementation of security tools used by SOC team. • Assist SOC manager with dashboards and business reporting. • Ready to work in rotational 24/7 shift.