NopalCyber- SOC Sr. Analyst

Job responsibilities:

\n
• Monitor, analyze, and interpret security/system logs for events, operational irregularities, and potential incidents, and escalate issues as appropriate
\n
• Responsible for monitoring, detection of analysis through various input tools and systems (SIEM, IDS / IPS, Firewalls, EDR, etc.)
\n
• Conduct basic red team exercises to test the effectiveness of preventive and monitoring controls
\n
• Provides support for complex system/network exploitation and defense techniques to include deterring, identifying, and investigating system and network intrusions
\n
• Support malware analysis, host and network, log analysis, and triage in support of incident response
\n
• Maintaining and improving the security technologies deployed, including creating use cases, customizing or better configuring the tools based on past and current threats
\n
• Monitoring threat/vulnerability landscape, security advisories, and acting on them as appropriate
\n
• Continuously monitors the security alerts and escalation queue, triages security alerts
\n
• Monitoring and tuning SIEM (content, parsing, maintenance)
\n
• Monitoring Cloud infrastructure for security-related events
\n
• Delivers scheduled and ad-hoc reports
\n
• Develop and coach L1 analysts
\n
• Author Standard Operating Procedures (SOPs) and training documentation
\n
• Work the full ticket lifecycle; handle every step of the alert, from detection to remediation
\n
• Generates end-of-shift reports for documentation and knowledge transfer to subsequent analysts on duty
\n

\n
• Perform threat-intel research, learn new attack patterns, actively participate in security forums.
\n

Job specifications:

Qualification:

\n
• Bachelor's degree in Engineering or closely related coursework in technology development disciplines
\n
• Certifications like CISSP, CEH, CISM, GCIH, GCIA are desirable
\n
• Experience with the following or related tools: SIEM Tools such as Splunk, IBM QRadar, SecureOnix; Case Management Tools such as Swimlane, Phantom, etc.; EDR tools such as Crowdstrike, Sentinel, VMware, McAfee, Microsoft Defender ATP, etc; Network Analysis Tools such as Darktrace, FireEye, NetWitness, Panorama, etc.
\n

Experience:

\n
• 4+ years of SOC related work experience
\n

Desired Skills:

\n
• Full understanding of SOC L1 responsibilities/duties and how the duties feed into L2/L3. The ability to take lead on incident research when appropriate and be able to mentor junior analysts.
\n
• Advanced knowledge of TCP/IP protocols and event log analysis
\n
• Strong understanding of Windows, Linux and networking concepts
\n
• Experience analyzing both log and packet data to include the use of WireShark, tcpdump and other capture/analysis tools
\n
• Good understanding of security solutions including SIEMs, Web Proxies, EDR, Firewalls, VPN, authentication, encryption, IPS/IDS etc.
\n
• Functional understanding of Cloud environments
\n
• Ability to conduct research into IT security issues and products as required
\n
• Working in a TAT based IT security incident resolution practice and knowledge of ITIL
\n
• Knowledge and experience with scripting and programming (Python, PERL, etc.) are also highly preferred
\n
• Malware analysis and reverse engineering is a plus
\n