MSS/TDR_SOC/SIEM_FY27Q3

Job Overview:

• Minimum experience in managing Information Security operations, with practical experience in a large-scale security operations center utilizing IBM QRadar, Splunk, ArcSight, or comparable SIEM tools
• Oversee network endpoints, lead forensics initiatives, conduct malware triage, and manage cyber security incident responses
• Direct Cyber Security Services engagements and supervise engagement teams
• Identify common tools, tactics, and procedures employed by attackers
• Provide oversight for on-site examinations, collections, and technology advisory services to improve forensic client engagements
• Research and create new digital forensics scripts, tools, and methodologies
• Evaluate and troubleshoot a range of technical issues while supporting a cyber response lab focused on our clients' SIEM tool and UEBA platform
• Assist in performing peer reviews and quality assurance assessments for junior team members, while mentoring incident managers and guiding others in incident management prioritization, triage, and reporting for on-site engagements
• Guide the team in monitoring, identifying, and investigating security alerts, as well as executing incident response activities related to cyber security incidents
• Generate trouble tickets for alerts that indicate an incident requiring Tier 2 Incident Response review
• Respond to cyber security incidents, conduct threat analysis as needed, and address identified incidents for resolution
• Possess the ability to multitask effectively to coordinate incidents with Senior Analysts and escalation managers
• Propose improvements to SOC security processes and operational efficiencies
• Develop Incident Response (IR) plans and playbooks, managing all incidents and crisis situations
• Perform log analysis to handle and resolve security incidents
• Collaborate with relevant technical teams for incident remediation
• Regularly review incident response plans and procedures
• Recommend and document specific countermeasures and mitigation controls
• Create thorough and precise reports and presentations tailored for both technical and executive audiences

Core Responsibilities:

• Preferred Skills
• Extensive knowledge of cyber attack methodologies and the Cyber Kill Chain, alongside incident management best practices
• A solid understanding of multi-tiered applications and various network and security devices and protocols
• Familiarity with different operating system varieties, including but not limited to Windows, Linux, and Unix
• Skilled in report preparation and documentation
• Understanding of cyber criminal tactics and compliance and regulatory standards
• Exceptional verbal and written communication abilities

Desired Skills:

Data Security->Public Key Infrastructure (PKI), DevOps->Google Cloud Platform (GCP), IDAM->CA Siteminder (CA Identity Suite), IDAM->IBM Security Identity Manager (ISIM), Infrastructure Security->Malware Analysis, Infrastructure Security->Symantec Endpoint (SEP), Network Security->Firewalls->Checkpoint, Network Security->Firewalls->Juniper, Network Security->Firewalls->Palo Alto, Network Security->Firewalls->Web Application Firewall (WAF), Security Incident and Event Management (SIEM)->ArcSight, Security Incident and Event Management (SIEM)->LogRhythm, Security Incident and Event Management (SIEM)->QRadar, Security Incident and Event Management (SIEM)->RSA Envision, Security Testing->Cloud Security, SOC, SOC->Security Monitoring, SOC->Security Operations Center (SOC/SIEM), Tools->ServiceNow->ServiceNow Security, Tools->Splunk