IT Security Analyst - Threat Hunting & Detection

Job Description :

- Proven experience in SOC, CERT, or CSIRT operations with strong background in Threat Hunting, Detection Engineering, and Incident Response.

- Expertise in building and simulating hypothetical threat scenarios to preempt attack vectors.

- Hands-on experience with KQL (Kusto Query Language) for creating advanced detection rules in Microsoft Sentinel.

- Strong familiarity with the MITRE ATT&CK framework, with practical use in detection rule mapping and identifying TTPs.

- Practical knowledge of key security technologies :

1. Firewalls, IDS/IPS, SIEM

2. Endpoint Detection & Response (EDR)

3. Anti-malware solutions.

4. Vulnerability assessment tools

- Proficiency with Microsoft Security Products :

1. Sentinel, Defender for Cloud, Endpoint, Identity

2. Microsoft 365 Security (Office 365, Exchange)

3. Azure Active Directory

- Sound understanding of networking, cloud infrastructure, Windows/Linux OS, and modern cyberattack methods.

- Ability to correlate threat intelligence feeds with detection rules to counter advanced threats.

- Experience analyzing large security log datasets and reducing false positives with precise rules.

- Skilled in log management, dashboard creation, and continuous monitoring systems.

- Strong verbal and written communication and collaboration skills.

- Proactive mindset, passion for cybersecurity, and continuous learning attitude.

Desired Behaviors :

- Strong collaborative approach within cross-functional teams.

- Clear and confident communicator of ideas and findings.

Threat Intelligence Analysis :

- Gather and analyze threat intelligence feeds.

- Communicate relevant threat insights and recommend actionable defenses.

Threat Detection Engineering :

- Develop and optimize KQL-based detection rules in Microsoft Sentinel.

- Simulate attack scenarios to enhance detection effectiveness.

- Tune detection systems for high precision and low false positive rates.

Incident Response & Forensics :

- Collaborate with SOC/CERT/CSIRT teams on incident handling.

- Conduct forensic analysis and trace attacker patterns during incidents.

Security Tool Management :

- Configure and manage tools like SIEM, Microsoft Defender, anti-virus, and dashboards.

- Maintain effective monitoring and alerting mechanisms.

Continuous Security Improvement :

- Assist in developing and applying security guidelines and concepts.

- Conduct vulnerability assessments, penetration tests, and internal audits.

- Support creation and optimization of SOC policies and procedures.

Preferred Certifications :

- Microsoft Certified: Security Operations Analyst Associate

- CEH (Certified Ethical Hacker)

- EC-Council Certified Incident Handler (ECIH).