Cyber Operations - Security Monitoring analyst

This is a 3^rd shift position 12AM-9AM EST

Job description – below

POSITION SUMMARY

These positions are for a Weekday or weekend Level 1 Security Monitoring analyst 3rd shift 12AM-9AM EST within a 24/7 Cyber Security monitoring environment. The purpose of the role is to work with various tools and technologies, preferably SIEM and EDR for discovering security incidents. Performing real time monitoring on malicious activities, intrusions, infiltration attempts, analyzing logs looking for attack patterns to ensure infiltration attempts are identified and dealt with in a timely manner. Performing security analysis and review the alerts, escalate to Level 3. Provide primary level of analysis and provide technical insights for security incidents.

PRIMARY DUTIES AND RESPONSIBILITIES

1. Primarily responsible for executing the security event assessment of security events from SIEM reporting systems, identify threats to our environment, remediate security threats and recovery of systems from security incidents.
2. Works closely with Level 2 & Level 3 team towards the continuous improvement of the service
3. Responsible to ensure that all applications are functional and secure (IT security, Application Security and Information Security)
4. Perform real time security monitoring and incident response activities across the global networks, leveraging a variety of tools and techniques
5. Detect incidents through use cases, threat intelligence and hunting process across security-relevant data sets
6. Recommend new, repeatable methods for finding malicious activities.
7. Ensure all standards including Security Incident Response Process and guidelines are followed
8. Must be able to communicate effectively with individuals at all levels of the organization.
9. Provides correlation and trending of critical cyber incident activity.
10. Improving the service level for security operations and monitoring.
11. Creating and maintaining system documentation for security event processing.
12. Author Standard Operating Procedures (SOPs) and training documentation
13. Analyze incident indicators and tactics, techniques, and procedures (TTPs) to identify tools, provide context and severity
14. Manage and maintain security tools to increase incident response efficiency
15. Improve ability to detect and respond to intrusions.
16. Help create and maintain process and tools documentation.

QUALIFICATIONS

Education and Experience

• Bachelor’s Degree from four-year college or university in Information Technology, Information Security/Assurance, Engineering or similar area of study required.
• Prefer 1-2 years SOC/ Information Security experience.
• Prefer 1-2 years of Cloud Security experience.
• Prefer Experience working as part of globally distributed teams.
• Prefer 1-2 years Managed Services experience
• Prefer 1-2 years SIEM technologies experience with Sentinel and XSIAM
• Prefer 1-2 years EDR technologies experience such as Cortex
• Prefer 1-2 years endpoint security technologies experience
• Preferred candidates will have one or more certifications in Cloud Security
• Proven ability to make decisions and perform complex problem-solving activities under pressure.
• Sharp analytical abilities and the ability to make sound decisions quickly required.