Description

You will perform Security Operations Center (SOC) duties, focusing on incident response, malware analysis, and monitoring.

Responsibilities

• Triage alerts and incidents, performing deep analysis and correlating with threat intelligence to identify threat actors and attack nature.
• Prioritize and triage security alerts to determine incident status and escalate to Tier 3 when SLA remediation targets are at risk.
• Analyze logs, network traffic, and other data sources to identify incident sources and record identified vulnerabilities.
• Build internal scripts, tools, and automation processes to improve detection and response capabilities.
• Adjust security tools and processes, such as modifying EDR alerting or updating detection rule conditions.

Required Skills

• 2-4 years of experience in Security Operations or Incident Response.
• Strong understanding of threat categories, including malware, phishing attacks, Defense-in-Depth, and MITRE ATT&CK framework.
• Practical knowledge of M365 Security tools, Azure, AWS, and GCP.
• Working experience with SIEM tools (Sentinel, Splunk, Elastic), EDR, firewalls, IDS/IPS, and anti-spam solutions.
• Strong knowledge of Windows, Linux, and/or Mac OS, including investigating Security Event logs.
• Good knowledge of networking protocols (SMTP, HTTP, HTTPS, FTP, DNS, DHCP).
• Experience with query languages and scripting languages.
• Experience using Security Orchestration, Automation, and Response (SOAR) tools.

Key Skills

Education

Bachelor's degree