Job Key Responsibilities:
Incident Detection and Response:
- Monitor and analyze security alerts from SIEM and other security tools.
- Conduct in-depth investigations of escalated security incidents from Level 1 analysts.
- Coordinate containment, eradication, and recovery efforts during security incidents.
Threat Hunting and Analysis:
- Perform proactive threat hunting to identify potential security gaps and vulnerabilities.
- Analyze threat intelligence and correlate it with internal data to detect malicious activities.
Tool Management and Optimization:
- Maintain and optimize security tools, such as SIEM, EDR, IDS/IPS, and SOAR platforms.
- Assist in tuning and configuring security systems to minimize false positives and improve efficiency.
Reporting and Documentation:
- Prepare detailed incident reports and summaries for technical teams and management.
- Maintain accurate records of incidents, investigations, and resolutions in the incident management system.
Training and Mentorship:
- Contribute to the continuous improvement of SOC processes and playbooks.
Job qualification:
Education and Certification:
- Bachelor’s degree in computer science, Cybersecurity, Information Technology, or a related field is preferred.
- Relevant certifications such as Enterprise Defense Administrator (eEDA), Certified Incident Responder (eCIR), Certified SOC Analyst (CSA), EC-Council Certified Incident Handler) is preferred
Experience:
- Minimum 0–2 years of experience in a Security Operations Center (SOC) or a similar cybersecurity role.
- Hands-on experience with SIEM tools (e.g., Splunk, Microsoft Sentinel, QRadar).
- Proven experience in incident detection, analysis, and response.
- Experience in threat hunting, malware analysis, and vulnerability assessment.
Technical Skills:
- Strong understanding of network protocols, architecture, and security principles.
- Proficiency in scripting and automation using Python, PowerShell, or similar languages.
- Knowledge of threat intelligence tools and frameworks (e.g., MITRE ATT&CK).
- Familiarity with endpoint detection and response (EDR) solutions.
- Ability to analyze security alerts, logs, and packet captures to identify threats.
Key Competencies:
- Advanced knowledge of cybersecurity threats, vulnerabilities, and attack methodologies.
- Strong analytical and problem-solving skills with the ability to handle complex incidents.
- Experience with intrusion detection/prevention systems (IDS/IPS) and firewall technologies.
Soft Skills:
- Excellent communication and report-writing skills for technical and non-technical audiences.
- Ability to work effectively under pressure and manage multiple priorities.
- Strong teamwork and collaboration skills to work within a cross-functional security team.
Preferred Qualifications:
- Experience in SOAR tools for automating incident response.
- Knowledge of cloud platforms (AWS, Azure, Google Cloud) and their security configurations.
- Experience in forensic investigations and root cause analysis.
