Description

You will perform security analysis and support incident response activities.

Responsibilities

• Analyze data and plan initial steps to address identified security issues.
• Assist in creating playbooks to manage identified threats.
• Execute existing playbooks to handle issues like compromised passwords or missing event logs.
• Produce reports detailing metrics such as MTTD/MTTR and maintain thorough case notes.
• Identify telemetry quality and visibility gaps across SIEM, EDR/XDR, and asset tagging.

Required Skills

• 1–3 years in a SOC, cybersecurity blue team, or related role.
• Strong grasp of TCP/IP, OSI model, HTTP, DNS, and SMTP.
• Fundamentals in Windows, Linux, and macOS, including Active Directory/Azure AD concepts.
• Experience with at least one SIEM and one EDR/XDR platform.
• Experience with ticketing and case management systems.
• Ability to craft queries using common languages, comfortable with regex, JSON, and APIs.
• Basic scripting ability in Python, PowerShell, or Bash.
• Excellent analytical, problem-solving, and communication skills under pressure.

Preferred Skills

• 3–5 years relevant experience in investigations and detection tuning.
• Comfort using Splunk Processing Language (SPL) and CrowdStrike EDR.
• Experience with SOAR tools and automation development.

Key Skills

Education

Any Gradute