Description :

In the role of Level 3 SOC Security Analyst, you will interface with key stakeholders for different business units and manage expectations at all levels within the business. You will play an important role in addressing real security incidents. Detect and evaluate incidents. Uses threat intelligence such as updated rules and Indicators of Compromise (IOCs) to pinpoint affected systems and the extent of the attack.

Analyse running processes and configs on affected systems. Carries out in-depth threat intelligence analysis to find the perpetrator, the type of attack, and the data or systems impacted. Create and implement a strategy for containment and recovery. Manage and prioritise actions during isolation, analysis, and containment of an incident. Communicate any special requirements of high severity incidents to both internal and external stakeholders.

Job Duties :

- Threat hunting, proactively identifying previously unknown, or ongoing non-remediated threats.

- SOC SIEM fine tuning and design improvements

- Working on MITRE framework

- Working with OWASP

- The SOC Security Analyst is responsible for conducting information security investigations due to security incidents identified from various SOC entry channels (SIEM, Tickets, Email and Phone).

- Act as a point of escalation in support of information security investigations to provide guidance and oversight on incident resolution and containment techniques.

- Create and maintain SOC Run books for Both AWS Cloud hosting and corporate systems

- Act as the lead coordinator for Bravura Solutions response to individual information security incidents.

- Mentor security analysts regarding risk management, information security controls, incident analysis, incident response, SIEM monitoring, and other operational tasks in support of technologies managed by the Security Operations Centre.

- Document incidents from initial detection through final resolution.

- Participate vulnerability management.

- Participate in evaluating, recommending, implementing, and troubleshooting security solutions and evaluating IT security of the new IT Infrastructure systems.

- Works as part of a team to ensure that corporate data and cloud hosting platform components are safeguarded from known threats.

- Communicate effectively with customers, teammates, and management.

- Prepare Monthly Executive Summary Reports for managed clients and continuously improve their content and presentation.

- Provide recommendations in tuning and optimisation of security systems, SOC security process, procedures, and policies.

- Define, create, and maintain SIEM correlation rules & customer build documents, security process and procedures.

- Follow ITIL practices regarding incident, problem and change management.

- Staying up to date with emerging security threats including applicable regulatory security requirements & AI

Other responsibilities and additional duties as assigned by the SOC Manager :

- In addition to the above position-specific responsibilities, all employees are required to undertake any other reasonable duties and responsibilities within your capability and skills, when requested to do so.

The successful candidate will need to support the team by taking active part in several other activities :

a) Between 10 and 20% of the time (depending on demand and availability of other team members) will be dedicated to the following additional duties :

- Review and evaluation of the security impact of changes as per established change review and approval processes applicable to various products, environments, or suppliers

b) Other duties may involve the following :

- Participation in the evaluation, selection and implementation of security products and technologies as part of defined project or programme activities

- Assurance & verification that all suppliers are operating in accordance with their agreed contractual obligations.

- vulnerability management and assessments.

Qualifications and Experience :

- Preferred Information Security professional designations such as CISSP, CISM, CISA.

- 5+ years previous Security Operations Centre Experience in conducting security investigations.

- Experience working in SOC Team responding to incidents and events in AWS cloud hosting is essential

- Demonstrated skills in digital investigations including computer forensics, network forensics, malware analysis and memory analysis.

- Must have advanced knowledge of Rapid7 insightIDR and insightVM

- Must have hands on experience with managing EDR services in AWS nodes (EKS, EC2)

- Must have knowledge of AWS cloud native services such as (SecurityHub,

- Ability to analyse data, such as logs or packets captures, from various sources within the enterprise and draw conclusions regarding past and future security incidents.

- Detail oriented with strong organisational and analytical skills.

- Strong written communication skills and presentation skills

- Self-starter, work independently and adjust to changing priorities, critical and strategic thinker, negotiator, and consensus builder.

- Strong knowledge of IT including multiple operating systems and system administration skills (Windows, Solaris, Unix)

- strong knowledge of client-server applications, multi-tier web applications, relational databases, firewalls, VPNs, and enterprise Anti-Virus products.

- Strong understanding of security incident management, malware management and vulnerability management processes.

- Experience with web content filtering technology - policy engineering and troubleshooting