Security Operations Analyst

The Position: The Security Operations (SecOps) Analyst role is one where we look to build a rich and capable team of security professionals to deliver security services to the SMB market. Our security analysts are expected to be involved in highly technical investigations and support the delivery of meaningful, accurate results for both internal and external customers in a dependable and targeted manner. Time management and in-depth knowledge of all internal and many external products and services are imperative to success. The successful candidate will be relied on to identify threats and handle any security incident or customer request in the SOC.
The analyst will apply their skills and knowledge in the day-to-day management Cyber activities including, but not limited to, performing and presenting security assessments, penetration tests, analyzing security logs and systems data to identify anomalous or irregular events; completing Cyber management processes to respond to, investigate and report on identified security incidents; maintenance of various security tools and technologies such as advanced malware detection, DDoS, IDS/IPS, DLP, Anti-spam as well as other Cyber threat intelligence and vulnerability management capabilities. The ideal candidate has experience not only using a wide range of technologies to respond to Cybersecurity events but diligent upkeep and continuous improvement of Cyber management processes and tools.
Responsibilities:

Apply investigative tactics, techniques, and procedures (TTPs) using your understanding of the security threats associated with the incoming signals to accurately follow Runbooks.

Analyze incoming security signals in real time with a balance of accuracy and speed using a variety of proprietary and third-party tools

Handle in-depth investigations, digital forensics (network, endpoint, log), and customer requests, conveying results to clients by e-mail and phone as needed.

Investigate security incidents and contribute to incident response reports and after-action reviews.

Participate in various internal projects and initiatives to increase SOC efficiency and improve SOC tooling.

Perform audits and secondary review of selected signals, following up with analysts and customers when necessary.

Block malicious network traffic, isolate infected hosts on customers’ networks, and perform other remediation actions using internal and third-party tools.

Complete intermediate customer support requests, service administration and troubleshooting tasks.

Support and mentor analysts during investigations or customer inquiries.

Identify gaps in processes and procedures and escalate them to the appropriate teams.

Provide input to our Learning and Development team on training content.

Perform manual triaging of triggered alerts to identify potential security incidents and threats

Document true positives and initiate incident response as needed

Lead individual stages of incident response as needed

Collaborate efficiently with internal and external stakeholders

Document incident response workflow and maintain chain of custody for collected evidence

Compile post-incident report and present evidence and documentation to executive and legal teams, and law enforcement agencies as needed

Support special security and compliance requirements of external parties

Ensure security operations duties are executed in accordance with security policies, procedures, and third party or compliance obligations

Ability to independently run threat hunting

Ability to independently perform security assessments, pen-testing and red-teaming in IT and OT environments

Requirements/Qualifications

3+ years' experience of overall network topology; network security; internet, intranet, extranet technologies; and operating systems.

A bachelor’s degree in Computer Science or Computer Engineering, or Electrical Engineering with a focus in Information Technology

Education: Practical relevant work experience in lieu of university degree in related area (Cybersecurity) accepted

Information security certifications, such as Security+, CySA+, CEH, PenTest+ are desirable.

Demonstrated leadership or initiative at school, work and/or community (extracurricular activities)

Growth mindset, with a passion for learning

Collaborative with an ability to cultivate relationships and networks

Agile, technically savvy, with a knack at creating solutions

Creative thinker with a unique ability for resourcefulness

Strong analytical and organizational skills, effective written and verbal communication skills, and team oriented.

Familiarity with information security vulnerabilities and risk management.

A high level of personal skills is required to make formal, persuasive presentations to groups and to deal effectively with people from all segments of the community.

(New graduate from bachelor’s in computer science or Computer Engineering or Electrical/Electronic Engineering with a focus in Information Technology)