SOC Lead

The main responsibility is to support the company's IT Security with activities related to Incident Response and threat intellegence of their security operation.

Responsibilites:

• Triaging, investigating and management of ongoing Cyber Security Incidents.
• Day to day management of the NDR, EDR and SOAR platform
• Support in the creation of operational documents such as- use cases, play/run books and training materials) on incident response and ensures regular updating of these documents.
• Support in the creation of various metrics, reporting, review of incident progress and compliance status
• Support Regional Security Operations to ensure the Security posture of business units are under proper measure, monitor and manage.

Requirements:

• Broad knowledge of and understanding of the security field and its core components
• Ability to work in a customer-facing environment, coordinate with internal and external parties
• Experience in security analyst Operations, specifically triage, investigation, and containment.
• Broad knowledge and understanding of Network data and able to troubleshoot Kusto Query Language (KQL) when results are not returning as expected.
• Broad knowledge and understanding of Computer operating systems
• Ability to understand Splunk use cases (SPL)
• A basic understanding of directory and identity management services.
• A basic understanding of cloud computing and infrastructure.
• A basic understanding of server and service operations.
• A general understanding of Attacker tools such as Remote exploit kits, Remote Access Tools etc.
• A high level of understanding of Attack taxonomy such as MITRE ATT&CK, Lockhead Martin Kill chain, Diamond model etc.