Security Operations Center

Job Description :

The Cybersecurity Advisor is responsible for the Security Operations Center Activity. This role will help develop innovative and effective procedures for the Security Operations Center to enhance response time, coordination and incident response operations, and build a world class team of Cyber Security Incident Response and forensics experts. Train staff on security concepts, develop incident response and forensics management process, write correlations, and integrate intelligence data into monitoring and operations activities. The Security Director/Manager will coordinate with company leadership for the development, implementation, and maintenance of security operations processes across the enterprise.

Key Responsibilities :

- Lead and participate in the Computer Emergency Response Team and the Computer Security Incident Response Team

- Lead day-to-day SOC Operations, ensuring continuous monitoring, detection and response to security events and incidents.

- Manage L2/L3 SOC analysts, incident responders and threat hunters fostering a high-performance culture

- Perform accurate and precise real-time analysis and correlation of logs/alerts from a multitude of client devices with a focus on the determination of whether said events constitute security incidents

- Analyze and assess security incidents and escalate to resources or appropriate internal teams for additional assistance

- Ensure adherence to incident response SLAs, escalation paths and communication protocols.

- Maintain measures to ensure information privacy, information security, and information assurance

- Establish and operate security events and log-monitoring delivery.

- Provide operational oversight of service delivery and ensure deliverables are timely and of high quality

- Identify/implement improvements to business processes, methodologies, and client communication methods.

- Perform Training, monitoring, and motivating a diverse group of SOC Analysts

- Manage project scopes and timelines, and assist in managing project budgets

- Participate in reviewing the design and development of significant new information systems and applications

- Maintain relationships with appropriate technology partners, both internal and external

Technical Requirements :

- Significant theoretical and practical knowledge in Exploits, vulnerabilities, network attacks

- Packet analysis tools (tcpdump, Wireshark, ngrep, etc.)

- Regular expressions

- 4+ years of hands-on experience in SIEM technologies like LogRhythm, SPLUNK, QRadar etc.

- 4+ years of experience in Incident response process and incident handling

- 3+ years of experience in network intrusion detection

Education and Experience :

- Bachelors degree in information systems, Computer Science, or related field or equivalent

- 7+ years of experience in Cyber Security

- 5+ years of experience with defensive Cyberspace operations

- Must possess one or more current, applicable professional/technical certifications, such as CISA, CISM, CSCS, CIPP, CISSP, CIA, GPEN, GWAPT, SANS GIAC/GSEC, or CEH

Preferred Qualifications :

- Experience with Information Security, Privacy, IT Audit, Compliance, and IT Management Standards, such as ISO/IEC 27001 and 27002, PCI-DSS, SSAE-16 SOC1 & SOC2, SOX, NIST 800-53, and the COBIT and COSO

- Advanced knowledge of Cyber Security management practices, network and application vulnerability assessments, change control, business continuity planning, data privacy, and risk assessment frameworks and practices