Blusapphire cyber systems - SOC L1 / L2 / L3

Job Responsibilities

Act as an escalation point for high and critical severity security incidents and conduct

thorough investigations to determine potential impact and understand the extent of

compromise.

Verify and authenticate events, alerts, and incidents reported by L1 analysts.

Analyze attack patterns, Tools, Techniques and Procedures (TTPs) to identify methods of

attacks and attack life cycle.

Defining, planning, implementing, maintaining, and upgrading security measures, policies,

and controls.

Carry out in-depth investigation and correlation and work with the stakeholders towards

mitigation and closure of critical, high severity and other complex incidents.

Developing and implementing novel threat detection content, rules, and use cases for

deployment in the SIEM platform involves working with diverse data sets, including Proxy,

VPN, Firewall, DLP, etc. This includes the creation of sophisticated and advanced rules while

ensuring precise fine-tuning for optimal performance.

Conduct analysis to gather evidence, validate root cause and analyze the extent of

compromise leveraging Client's security toolset.

Collaborate with cross-functional teams, to ensure end to end management of security

incident lifecycle.

Conduct thorough investigations to identify true positives from false positives, prioritize

incidents, and recommend appropriate actions.

Respond to incident escalations and provide solid recommendations.

Identify and leverage emerging threat intelligence (IOCs, updated rules, etc.) to identify

affected systems and the scope of the attack.

Ensure process compliance through regular reviews and updates of existing SOPs, processes,

standards, guidelines, and checklists on a periodic basis (quarterly/half-yearly). Additionally,

assist in the development and improvement of Security Operations processes, involving the

creation or modification of SOPs, Playbooks, and Work instructions.

Perform Advanced diligent Threat correlation between multiple security event sources such

as firewall logs, threat intelligence feeds, AV, IDS, IPS, and MDR solutions

Train L1/L2 via planned knowledge transfer & internal training sessions.

Job Requirements

Minimum 8 years' experience working in a large-scale IT environment with focus on Cyber /

Information Security.

Strong Knowledge of Network security (Firewalls, Proxies, IDS/IPS, Vulnerability Scanner).

Seasoned in Digital forensics, malware assessment, and Threat Hunting.

5+ years of hands-on experience on leading analytical platforms like Splunk, Qradar,

Hunters, SumoLogic, Sentinel. Knowledge of other security technologies (such as Email

Security Gateway, SOAR, IPS/IDS, Proxy, EDR, TI, DLP, CASB, PAM etc.) will be an added

advantage.

Deep understanding of MITRE ATT&CK Framework.

Customer-facing, with good report-writing skills and strong communication skills at all levels.

Ability to provide technical and service leadership to L1 analysts. Be a thought leader in the

SOC.

Knowledge of Security Best Practices and Concepts.

Conducting vulnerability testing and risk analyses to assess security and performing internal.

and external security audits.

Strong analytical and problem-solving skills.

Lead incident investigation and response activity

Participate in on-call rotation for after-hours security incident escalations.

Capability to communicate and listen to needs from organizational or client stakeholders.

Staying up to date with emerging security threats

Well-developed logical thinking capabilities, to be able to investigate cases.

Reliability and overall good communication skills - both verbal and written.

Able to work in shift schedule.

Staying up to date with emerging security threats.

Good interpersonal skills - clear communication, attentive & careful listening, empathetic

behavior, being positive, supporting useful ideas & honest efforts of colleagues, being

positive.