We will jointly build and maintain a career development plan, and work together to ensure that you're making regular progress towards your goals.
What you'll be doing
- Analyzing metrics, incident data, and new log sources to find opportunities for new alerts, and then writing those alerts
- Identifying ad hoc response procedures that can be routinized and then automated, and then authoring that automation
- Leading and participating in investigations of possible security incidents, diving as deeply into the technical details as your knowledge and interest allows
- Keeping informed about industry standard methodologies and trends in Security, Monitoring, Response, Threat Intel, and Forensics, and then making recommendations about products and procedures we should adopt
- Learning to think at a strategic level that encompasses more than just technical and security concerns, and then applying that perspective to make risk assessments and drive incident response decisions
What we're looking for
- Experience as a Security Analyst or similar role in a Security Operations Center.
- Experience writing detections/alerts, and/or automated or manual runbooks and experience with SIEM such as Elastic, Sumo, Splunk
- Experience with one or more Cloud platforms is a must GCP, AWS or Azure.
- A desire to help craft the Security Operation Team's vision, culture, tool selection, methods and procedures
- A preference for working collaboratively, with a natural inclination to take pride in mentoring and helping others to succeed.
You might also have
- Experience with the Elastic stack and/or XSOAR
- Experience with forensics and at least one forensics tool, such as Magnet
- Experience with Threat Intelligence and several Threat Intelligence feeds