Technical Skills Required:

- Strong knowledge of SOC operations, incident detection, investigation, and response.

- Hands-on experience with:

1. SIEM: Sekoia.io

2. EDR/XDR: SentinelOne

3. SOAR: Palo Alto Cortex XSOAR

4. Email Security: Proofpoint

- Experience investigating endpoint, network, cloud, identity, and email security threats.

- Strong understanding of threat detection methodologies and incident response processes.

- Expertise in security monitoring, log analysis, and cybersecurity operations.

- Strong stakeholder management, communication, and collaboration skills.

- Analytical thinking, reporting, and problem-solving capabilities.

- Good knowledge of networking concepts and security technologies.

Good to Have:

- MITRE ATT&CK Framework.

- Threat Hunting.

- ServiceNow and Jira.

- Cloud Security Monitoring.

- Scripting and Automation.

- Product Ownership and Agile Delivery Practices.

- Vulnerability Management.

- Detection Engineering concepts and use case development.

Key Responsibilities:

- Investigate security alerts from security tools and business stakeholders.

- Perform triage, qualification, and analysis of potential security incidents.

- Validate incidents and determine severity, impact, and scope.

- Lead investigations involving endpoint, network, cloud, identity, and application telemetry.

- Coordinate containment and remediation activities with IT and business teams.

- Maintain detection standards, operational procedures, and knowledge management repositories.

- Identify areas for improvement and recommend enhancements to security products and monitoring capabilities.

- Support continuous improvement of SOC tools, detection use cases, automation workflows, and response processes.

- Collaborate with Detection Engineering teams to improve detection coverage and reduce false positives.

- Support platform enhancement initiatives by documenting requirements, evaluating solutions, and tracking implementation progress.

- Develop operational metrics, dashboards, and reports to measure security operations effectiveness.

- Ensure continuous security monitoring and incident response coverage within a global operating model.

- Collaborate with Product Owners, Cybersecurity teams, IT teams, and business stakeholders.