Responsibilities :
- Security Monitoring & Incident Response
- Monitor, manage, and respond to security events and incidents.
- Ensure timely identification, assessment, and quantification of security incidents, followed by accurate reporting, communication, and mitigation.
- Handle incident detection and response, leveraging knowledge of incident response methodologies to minimize impact and conduct post-incident analysis.
- Work closely with cross-functional teams during security breaches to ensure containment and remediation.
- Threat Analysis & Vulnerability Management
- Analyze network traffic, logs, and other data sources to detect potential threats and respond accordingly.
- Utilize advanced tools and techniques to proactively identify emerging risks and recommend appropriate remediation actions.
- Participate in vulnerability assessments and penetration testing to enhance exploitation detection.
- SIEM Integration & Operations
- Ensure the integration of standard and non-standard logs into SIEM systems.
- Contribute to the continuous improvement of security operations by refining standard operating procedures (SOPs) for incident response and other key processes.
- Threat Intelligence & Proactive Defense
- Stay updated on emerging threats, vulnerabilities, and cybersecurity trends through ongoing research and engagement with cybersecurity communities.
- Incorporate relevant threat intelligence into daily analysis to enhance detection capabilities.
- Documentation & Reporting
- Create detailed incident reports, summaries, and operational documentation.
- Maintain accurate records of incidents, investigations, and mitigation efforts for continuous improvement and auditing.
Qualifications :
- Education: Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent practical experience.
- Experience: Minimum 2 years in a SOC, CERT, or a similar cybersecurity role.
- Technical Proficiency: Hands-on experience with EDR, SIEM, and SOAR tools. Ability to analyze network traffic, logs, and security artifacts. Scripting skills and Windows forensics are a plus.
- Certifications: Preferred certifications include CHFI, ECSA, ECIH, CySA+, or CDSA.
- Skills: Strong understanding of common IT protocols (network, system, email). Familiarity with incident response processes including containment, eradication, and recovery.
- Soft Skills: Excellent problem-solving skills, with the ability to handle pressure and respond effectively in crisis situations.