Description

You will perform security analysis and support incident response activities.

This role is remote.

Responsibilities

• Analyze security data and plan initial steps to address identified issues.
• Assist in creating and executing playbooks for threats like compromised passwords or missing logs.
• Produce reports detailing metrics such as MTTD/MTTR and maintain thorough case notes.
• Identify telemetry quality and visibility gaps across SIEM, EDR/XDR, and asset tagging.

Required Skills

• 1–3 years in a SOC, cybersecurity blue team, or related role.
• Strong grasp of TCP/IP, OSI model, HTTP, DNS, and SMTP.
• Fundamentals in Windows, Linux, and macOS, including Active Directory/Azure AD concepts.
• Experience with at least one SIEM and one EDR/XDR platform.
• Experience with ticketing and case management systems.
• Ability to craft queries using common languages, comfortable with regex, JSON, and APIs.
• Basic scripting ability in Python, PowerShell, or Bash.

Preferred Skills

• 3–5 years relevant experience in investigations and detection tuning.
• Comfort using Splunk Processing Language (SPL) and CrowdStrike EDR.
• Experience with SOAR tools and automation development.

Key Skills

Education

Any Gradute