Role Proficiency:

Monitor cyber security s for our global customers in a 24x7x365 operations team under minimal supervision of Team Lead. Mentor junior members of the team as well as assist the Team Lead in supervision.

Outcomes:

      Mentor junior members of the team to help them learn and achieve their full potential.       Respond independently to low and medium complexity incidents       Assist the Team Lead in supervisory activities leading to a high-performance organisation.       Under the overall supervision of Team Lead ensure that cyber security s from the SIEM and multiple sources are dealt with by the entire team within SLA. Communicate and escalate as per defined process.       Train and motivate the team to follow documented playbook.       Assist the Team Lead in ensuring quality of service across the team.       Review and recommend topics for inclusion or upgrade in the playbook as well as new Use Cases or the refinement of existing ones.       Adherence to defined SOC processes including housekeeping tasks. Adherence to the Information Security policies as defined by the company and customer.

Measures of Outcomes:

      Innovation: Case Studies and value delivered to customer / Cyberproof.       Team adherence to SLA as agreed with the customer.       Productivity (Number of s addressed)       Quality - Percent of tickets that met quality norms       Adhere to process – Nil NC during audits Evidence of skill development including training certification etc.

Outputs Expected:

Cyber Security Monitoring :

Work in accordance with the Playbook
under supervision of the team lead to monitor s in the CDC Platform / SIEM Tool
etc. Ensure appropriate response in line with the SLA.

Cyber Security Incident Management:

Process s through analysis
triage and resolution. Communication and escalation as per defined process Documentation including annotation in CDC / SIEM work log to ensure audit trail
as per defined standards and quality requirements. Reporting

Team Player:

Assist the team lead in ensuring Continuous Learning as well as in delivering on innovation and optimization Mentor junior team members where possible.

Reporting:

Assist Team Lead in generation of required reports
management information and analytics.

Other Responsibilities:

Ensure that the housekeeping tasks are performed Undertake activities for example quality checks
reviews
etc. to ensure that the team as a whole are performing to standard requirements Stand in for the team lead when required at customer meetings
etc. Assist in achieving near zero false-positives
etc.

Skill Examples:

      High proficiency in the use of CDC SIEM and other relevant tools       Skill to review and recommend Play Book improvements Use Case Refinements New Use Cases Process Improvements etc.       Excellent logical problem-solving ability and analytical skills for incident triage and analysis       Excellent oral and written communication skills.       Continually learn new technology and stay updated on cyber threats. Assist and motivate team members to do likewise       Ability to work in rotating shifts and also be on-call outside of shift hours on a regular and recurring basis. Possess unimpeachable personal and professional integrity. Individuals will be required to submit to a background check.

Knowledge Examples:

      3 to 5 years experience as SOC operations with SOC of global organization.       University Degree in Cyber Security (no back papers) / Bachelor’s in Science or Engineering with training in cyber security       Highly proficient in Cybersecurity Incident Management process.       Highly proficient and up to date in cyber security s and incidents. Intermediate understanding of enterprise IT Infrastructure including Networks Firewalls OS Databases Web Applications etc.       Understanding of ISMS principles and guidelines; relevant frameworks (e.g. ISO27001) Desirable – Training / Certification in Ethical Hacking Tools Process and Frameworks related to cyber security etc.

Additional Comments:

We are seeking a highly motivated and security-conscious Security Operations Engineer to join our team. As a Cybersecurity Analyst you work closely with the Cybersecurity Lead to be the front-line defence for the company's networks, systems, and data. This includes analysing potential security risks, developing plans to address them (firewalls, encryption, etc.), monitoring for suspicious activity, and taking corrective actions. The Cybersecurity Analyst plays a key role in reporting on the company's security posture, threats, and any security breaches. Responsibilities: SOC Analyst L2 would work closely with SOC L1 team, L3 team & customer and responsible for performing deeper analysis and need to interact with client in daily calls and need to take the responsibility of handling the True Positive incidents on time. When L1 escalates an incident to L2, need to conduct more analysis and, if needed, escalate to the L3 team, or L2 analyst must advise L1 team members until the incident is resolved. Perform deep analysis to security incidents to identify the full kill chain Perform remediation steps according to the findings or initiate steps for remediation Prepare RCA for major incidents Handle L2 and above level technical escalations from L1 Operations team and resolve within SLA. Identify the security gaps and need to recommend new rules/solution to L3/Customer Need to suggest finetuning for existing rules based on the high count/wherever required Create and manage the Incident handling playbook, process runbooks and ad-hoc documents whenever needed Recommend finetuning for s with logic and threshold, and possibly the query as well for the SIEM Recommend new usecases with logic and threshold, and possibly the query as well for the SIEM Respond to clients’ requests, concerns, and suggestions Proactively support L1 team during an incident. Performs and reviews tasks as identified in a daily task list. Ready to work in 24x7 rotational shift model including night shift Incident detection, triage, analysis and response. Coordinating with customers for their security related problems and providing solutions. Share knowledge to other analysts in their role and responsibilities Provide knowledge transfer to L1 such as advance hunting techniques, guides, cheat sheets etc Knowledge Experience: Minimum 7 Years of experience in Security Operations Security event monitoring, triage, and thorough incident investigation. Research and understand log sources for effective security monitoring. Isolate issues, respond to incidents, and mitigate threats swiftly. Adjust SIEM rules for better and incident specifications. Optimize SIEM capabilities, aid in audit/logging, and generate timely reports. Conduct vulnerability scans, prioritize, and plan remediation. Proactively search for suspicious activities through Threat Hunts. Offer valuable Threat Intelligence to verify security concerns. Identify endpoint threats using EDR/AV analysis and Cybereason scans. Develop and maintain security operation standards, procedures, and playbooks. Essential Skills: Experience working with SIEM solutions (preferably Qradar) Experience with EDR solutions (preferably CrowdStrike) Experience with firewalls (preferably PaloAlto) Experience with email security gateways (preferably Mimecast) Experience with cloud security (preferably AWS) Experience with IAM solutions (preferably Okta) Continuous Learning innovation and optimization: Ensure completion of learning programs as suggested by Managers Suggest ideas that will help innovation and optimization of processes. Help develop the ideas into proposals. Provide suggestions to reduce the manual work Strong verbal and written English communication Strong interpersonal and presentation skills Ability to work with minimal levels of supervision Avialable to work in a 24x7 Security Operation centre (SOC) environment- shared MSSP.