Sr. SOC Analyst

Sr. SOC Analyst

Client: TriWest

POP: 12+ months

Location: Remote

REQUIRED SKILLS

• Bachelors + minimum 7 years of relevant work experience.
• 5+ years of experience working in a 24x7x365 SOC environment.
• 5+ years of experience in the areas of incident detection and response, remediation malware analysis, or computer forensics.
• One of the following certifications: Security +, CEH, CFR, CCNA Cyber Ops , CCNA-Security, CySA+ **, GCIA, GCIH, GICSP, Cloud+, SCYBER, PenTest+.
• Analyzing system and network logs for security events, anomalies, and configuration issues.
• Experience working with SIEM technology to monitor and manage security events.
• Background in incident response, system/network operations and threat intelligence.
• Experience utilizing enterprise security technologies such as SIEM/SOAR, NGAV/EDR, Vulnerability scanners, and Threat Intelligence Platforms.
• Understanding of enterprise environments, specifically cloud-based and hybrid cloud environments.
• Understanding of common cyber intrusion frameworks such as Cyber Kill Chain, Diamond Model, MITRE ATT&CK with the ability to train others.
• Hands-on troubleshooting, analysis, and technical expertise to resolve incidents and/or service requests.
• Understanding of possible attack activities such as network reconnaissance probing/ scanning, DDOS, malicious code activity, etc.
• Ability to script in one more of the following computer languages Python, Bash, Visual Basic or Powershell.
• Experience in two or more of these specialized areas: Insider Threat, Digital media forensic, Monitoring and detection, Incident Response.
• Understanding and experience with Federal Security Standards such as NIST and DoD.
• Understanding and experience with FedRAMP Cloud Security Requirements.

TASKS

• Perform alternating shift work on a 24x7x365 Security Monitoring, Analysis and Response.
• Support incident investigations, response, and reporting.
• Security Reporting.
• Vulnerability Analysis.
• SOC ticket queue management.
• Document actions taken and analysis in the authorized ticketing system to a level of detail where the actions taken and analysis are capable of being systematically reconstructed.
• Security documentation review and updates.
• Proactive threat hunting.