Summary
A pivotal role in the APAC Security Operations Center (SOC) responsible for operation, maintenance, and monitoring of Security portfolio. This role performs security event management functions - monitoring, detection, triage of security events and alerts in SIEM and associated monitoring systems.
Provides mentoring, training and escalation support to the Security Analysts. As a Senior SOC Analyst, you will learn how to work with various platforms including SIEM, SOAR, EDR, NDR, CNAPP and UEBA platforms to monitor security events, prioritize alerts, investigate & remediate incidents and how to help our customers by identifying security threats and preventing data breaches.
The Main Responsibilities
- Monitor, triage and response to alerts for client security events detected on the various monitoring system.
- Investigation and resolution of outage or abnormal behavioral scenarios on MSS products.
- Research and implement customer generated change requests for MSS products.
- Generate incident cases and escalate to superordinate teams in accordance with time and severity-based SLA’s;
- Perform tasks associated with the installation, turn up and maintenance of Lumen security infrastructure.
- Manage technical workload and engage Incident Response Analysts and management
- Inclusive of serving as the technical escalation by the L1 SOC Analyst
- Perform complex changes within the managed security environment and manage and resolve customer fault and service outage / impairment events.
- Present as technical expert delivering solutions to clients, internal business and third-party vendors.
- Develop enhancements to existing solutions, promote creation of new tools, processes and applications such as alert fine-tuning, create, review and/or update of existing SOPs
- Directly support, train and mentor the Security Analysts.
- Participate in company sponsored job related activities plus training to further develop your management and technical skills.
What We Look For in a Candidate
- Minimum 3 years of professional work experience in Information Security with SOC environment;
- Relevant security certifications (e.g. CompTIA Security+, CISSP, SANS GIAC);
- Working towards completion or has a BS/BA degree in Computer Science, Information Technology, or related discipline or equivalent experience;
- Strong understanding of threat landscape and expert analytical skills to define risk, identify potential threats, document and develop action/mitigation plan;
- A passion for information security and data security;
- Knowledge/experience with Operating Systems (e.g. Windows Server, CentOS Linux);
- Knowledge/experience with public Cloud infrastructure providers (e.g. AWS, Azure, GCP) and understanding of cloud concepts like VPC, IAM roles, IaC, Containers and Orchestration, CI/CD, etc;
- Knowledge/experience of networking (TCP/IP, HTTP, DNS, SMTP, etc) and firewalls (e.g. Fortinet, Cisco, Palo Alto, Checkpoint, Juniper);
- Working knowledge of Log Management/SIEM (e.g. CrowdStrike, Fortinet, Splunk, Microsoft Sentinel, Google) and Endpoint Detection and Response (CrowdStrike, SentinelOne, Microsoft) and Cloud Security;
- Good to have programming and scripting skills (e.g. Bash, Python, Perl, Powershell);
- Exceptional customer service skills with working ITIL experience
- Detail oriented individuals that work well in a team environment and have a hunger to learn;
- Strong verbal/written communication and interpersonal skills are required to document and communicate findings, escalate critical incidents, and interact with customers, managers and vendors;
