Description:
- Lead triage, investigation, and response of complex security incidents, performing root cause analysis and coordinating remediation efforts.
- Develop, maintain, and execute incident response playbooks and procedures.
- Conduct advanced threat hunting using threat intelligence, MITRE ATT&CK framework, and IOC (Indicators of Compromise) analysis.
- Manage endpoint and network security tools including EDR/XDR solutions, firewalls, IDS/IPS to detect and mitigate threats.
- Collaborate with vulnerability management teams to prioritize and remediate security risks using tools like Nessus, Qualys, or Rapid7.
- Automate security processes through SOAR platforms and contribute to continuous improvement of SOC workflows.
- Prepare detailed incident reports and post-mortems for stakeholders and compliance audits.
- Maintain compliance with industry security frameworks such as NIST, ISO 27001.
- Use ticketing and case management tools (ServiceNow, JIRA) for efficient incident tracking and resolution.
- Mentor and support junior SOC analysts in incident handling and escalation protocols.
Required Skills & Experience:
- Hands-on expertise with SIEM tools such as Splunk, QRadar, Azure Sentinel, ArcSight, or LogRhythm.
- Proficient in threat intelligence analysis, threat hunting methodologies, and MITRE ATT&CK framework.
- Strong experience with endpoint and network security technologies including EDR/XDR tools (CrowdStrike, Microsoft Defender, Carbon Black), firewalls, IDS/IPS.
- Skilled in incident response techniques: malware analysis, log correlation, root cause analysis, and playbook execution.
- Working knowledge of vulnerability management tools like Nessus, Qualys, Rapid7.
- Experience using ticketing systems such as ServiceNow or JIRA for incident management.
- Solid understanding of SOC processes, security automation (SOAR), and compliance frameworks (NIST, ISO 27001).
- Knowledge of Wazuh SIEM/EDR tools is a plus.
- Strong analytical, communication, and collaboration skills with ability to work under pressure in a fast-paced environment
Did you find something suspicious?
Posted By
Posted in
CyberSecurity
Functional Area
IT Security
Job Code
1558732
Interview Questions for you
View All