Description

You will own SOC operations, threat detection, and incident escalation for network security infrastructure.

This role is on-site.

Responsibilities

• Tune and manage IDS/IPS platforms (Cisco Firepower, TippingPoint) to reduce false positives and improve threat-driven detection.
• Perform advanced packet capture and network analysis using Corelight, NetWitness, and CRIBL to identify anomalies and lateral movement.
• Maintain and tune EDR platforms (CrowdStrike Falcon, SentinelOne), integrating telemetry into SIEM and orchestration workflows.
• Operationalize threat intelligence from Recorded Future, GreyNoise, and Mandiant into SIEM rules and automated enrichment logic.
• Escalate complex incidents to senior analysts and incident responders, providing enriched network-level intelligence.

Required Skills

• 5+ years of hands-on SOC operations experience.
• Proficiency with Cisco Firepower and TippingPoint signature tuning.
• Advanced network analysis using Corelight, NetWitness, and CRIBL pipelines.
• Experience with CrowdStrike Falcon and SentinelOne EDR platforms.
• Proficiency with Google SecOps and Cyware (SOAR) for automated workflows.
• Ability to map detection logic to adversary TTPs.
• Experience integrating SIEM, IDS/IPS, EDR, and Jira ticketing.

Preferred Skills

• Security certifications: CISSP, CEH, GISF, GSEC, CySA+, or Sec+.
• Experience converting indicators from ThreatMon, Google Threat Intelligence, and VirusTotal.

Key Skills

Education

Any Gradute