SOC Analyst will serve as cybersecurity expert for broader Security organization and is expected to provide and implement recommendations for improvement in cybersecurity posture and scope.

Working within the Security Operations Center team, they are responsible for discovery and identification of gaps and inadequate protection, collaborating solution and consulting in rollout and enforcement. The Analyst will ensure that new environments are identified and understood to enable accurate and actionable reporting for other tiers of Security organization and additionally is expected to actively participate in developing processes, procedures, training, etc. for new technologies.

The candidate must have a curious investigative mind, an interest in information security, and the ability to communicate complex ideas to varied audiences.

Key Responsibilities And Accountabilities:

• Track threat actors, their tactics, techniques, and procedures (TTPs), and their associated Indicators of Compromise (IOCs)
• Capture intelligence on threat actor TTPs/IOCs and coordinate with SecOps pods to develop countermeasures.
• Perform analysis, data driven investigations, provide automated reports and dashboards allowing broader security organization proactively identify gaps and outliers
• Perform Root Cause Analysis of security incidents to develop enhancements to existing alerting tools
• Compile detailed investigation and analysis reports for internal SecOps consumption and delivery to management
• Assist in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, end-user interviews, and remediation efforts
• Develop advanced queries and alerts to detect adversary actions
• May perform other relevant duties as requested.

Educational Background:

• Bachelor’s degree in computer science, Information Security, or a related field.

Technical Skills:

• 3+ years of experience in Information Security (Required)
• 1+ years of experience with the incident response process, including detecting advanced adversaries, log analysis using SIEM, and malware triage (Required)
• Experience with packet analysis and usage of deep packet inspection toolsets.
• Knowledge and experience working with the Cyber Kill Chain Model, Diamond Model or MITRE ATT&CK Matrix.
• Familiarity with EDR/SOAR/ML-based anomaly detection solutions
• Prior experience working with in the following areas: (Desired)
• Computer Incident Response Team (CIRT)
• Computer Security Incident Response Center (CSIRC)
• Security Operations Center (SOC)
• Experience with APT/crimeware ecosystems (Desired)
• Industry certification such as the following: (Desired)
• SANS (GCIH, GPEN, GWAT, GXPN, GCFA, GCFE, GREM)
• Offensive Security (OSCP, OSWE, OSCE, OSEE)

Soft Skills:

• Excellent communication skills (both written and verbal)​
• Strong problem-solving skills
• Detail-oriented
• Analytical Thinking