IT&Data Sr. Product Analyst CERT Asia

Position Overview:

• The SOC Product Analyst plays a crucial role in the advanced validation and response to cybersecurity incidents.
• This position entails conducting comprehensive analyses of alerts from security monitoring systems and collaborating with business stakeholders to carry out incident investigations, facilitate containment and remediation efforts, and enhance detection capabilities continuously.
• The analyst serves as the technical liaison among Detection Engineering, Incident Response, Threat Hunting, and Security Platform teams, aiming to boost the efficacy, scalability, and dependability of security monitoring and response operations.
• This role emphasizes the ongoing improvement of detection content, telemetry coverage, response automation, investigation workflows, and overall SOC platform efficiency through engineering-centric analysis and prioritization.
• Moreover, the analyst assists in the enhancement of cybersecurity products and platforms by collecting operational requirements, pinpointing improvement opportunities, defining use cases, and contributing to the progressive development of SOC capabilities.
• Working Schedule
• The SOC analyst team functions within a global security monitoring framework to guarantee uninterrupted incident detection and response.
• The role requires participation in rotational shifts covering both weekdays and weekends.
• Support across multiple geographical regions and time zones is essential.
• Engagement in a global 24x7 security operations model is required.
• Availability for incident response escalations and critical security events as necessary.

Primary Responsibilities:

• Core Responsibilities
• Examine security alerts from security tools and business stakeholders.
• Conduct triage, qualification, and analysis of potential security incidents.
• Authenticate incidents and assess severity, impact, and scope.
• Lead investigations that encompass endpoint, network, cloud, identity, and application telemetry.
• Coordinate containment and remediation efforts with IT and business units.
• Maintain detection standards, operational protocols, and knowledge management systems.
• Identify improvement areas and propose enhancements to security products and monitoring functionalities.
• Contribute to the ongoing enhancement of SOC tools, detection use cases, automation workflows, and response mechanisms.
• Collaborate with Detection Engineering teams to enhance detection coverage and minimize false positives.
• Assist in platform enhancement projects by documenting requirements, assessing solutions, and monitoring implementation progress.
• Create operational metrics dashboards and reports to evaluate the effectiveness of security operations.
• Ensure consistent security monitoring and incident response coverage within a global operational framework.
• Engage collaboratively with Product Owners, Cybersecurity teams, IT departments, and business stakeholders.
• Required Skills and Competencies - Must Have
• In-depth knowledge of SOC operations, incident detection, investigation, and response.
• Hands-on experience with:
• o SIEM Sekoia.io
• o EDR/XDR SentinelOne
• o SOAR Palo Alto Cortex XSOAR
• o Email Security Proofpoint
• Experience in investigating threats related to endpoint, network, cloud, identity, and email security.
• Robust understanding of threat detection methodologies and incident response protocols.
• Proficiency in security monitoring, log analysis, and cybersecurity operations.
• Excellent stakeholder management, communication, and collaboration skills.
• Strong analytical thinking, reporting, and problem-solving abilities.
• Good grasp of networking principles and security technologies.
• Required Skills and Competencies - Good to Have
• Familiarity with the MITRE ATT&CK Framework.
• Experience in Threat Hunting.
• Knowledge of ServiceNow and Jira.
• Proficiency in Cloud Security Monitoring.
• Experience in Scripting and Automation.
• Understanding of Product Ownership and Agile Delivery Practices.
• Knowledge of Vulnerability Management.
• Familiarity with Detection Engineering concepts and use case development.

Technical Qualifications:

• Experience and Qualifications
• Total Experience: 5 - 8 years
• Relevant Experience: 3 - 5 years in one or more of the following domains:
• SOC Operations
• Security Monitoring
• Incident Response
• Detection Engineering
• Security Tool Administration
• Cybersecurity Product Management
• Education: Bachelor’s Degree in Cybersecurity, Computer Science, Information Technology, or a related discipline.
• Preferred Certifications
• Microsoft SC-200
• GCIH
• Security
• GCFA
• ITIL
• CSPO
• Other relevant cybersecurity or product management certifications.

Preferred Skills:

SOC, Technology->Infrastructure Security->Security Incident and Event Management (SIEM)->IBM Qradar, Technology->Infrastructure Security->Threat Hunting, Technology->Security Operations->SOAR