Job Description :
The resource would be expected to play active role in maintaining the integrity and security of Enterprise.
He will have to own incident response, do triage and investigation, assist with classifying security events, develop remediation plan, provide guidance as needed and assist with system security compliance.
The responsibility would include:
Work on the alerts received from Tier 2 SOC.
Drive/Guide teams to take appropriate actions on Security incident received
Perform advanced analyses of potentially malicious activities that have occurred, or are believed to have occurred, on customer network
Consolidate and conduct comprehensive analysis of threat data obtained from various sources
Do Proactive analysis of logs to identify trends in attacks, targeting, and timing of suspicious/malicious activity.
Perform scripting and create custom parsers as necessary for investigation and fine-tuning of SIEM
Guide team on remediation of vulnerabilities based on the alerts received
To increased maturity of SIEM tool, give feedback to SOC tier 2 & Tier 1 team based on the alerts received and outside events.
Qualifications:
Bachelor''s degree in Computer Science, Engineering, IT, Cybersecurity, or related field.
At least 7-10 years of professional experience in incident detection and response, malware analysis, or cyber forensics.
Extensive experience in at least one SIEM technology.
Extensive Experience in Incident Response, Log Analysis, Network Traffic Packet Analysis, and email analysis
Should be able to use advanced forensic tools and techniques for attack reconstruction, and possess network security architecture and domain knowledge to develop systems and exploitation methods.
Good understanding of network security architecture, incident detection and response, malware analysis, or cyber forensics.
Good understanding in security control compliance, information risk management, or information systems risk assessment, and security tools implementation.
Good understanding of working and log formats of technologies like Firewalls, IPS/IDS, Proxies, Active Directory, Operating systems, DLP, NAC etc.
Good understanding of Cloud Security concepts
Scripting knowledge – Python /Powershell etc. preferred
CEH, ECIH , GCIH preferred.