Securities Operations Analyst

Security Operations Center Analyst II

The Security Operations Center Analyst II serves as vital member of the Security Operations Center within the Clients Information Security Office, performing continuous monitoring of critical systems for the Client. The candidate will be a member of a team focused on endpoint detection and response, antivirus protection, endpoint investigations, and other endpoint security and incident response activities. The candidate must be knowledgeable about how the products and processes fit into the broader Security Program and generally understand information security concepts, methods to combat emerging threats, and adversary Tactics, Techniques, and Procedures.

The candidate will be primarily responsible for Tier II level SOC Analyst duties with our Endpoint Security and Incident Response group, with an opportunity to participate in our Vulnerability Management and Testing processes as needed to meet the operational requirements and goals of the SOC. Oncall work will be required for this postion.

Representative Tasks:

• Understanding of detection and response, antivirus, and other endpoint security topics based on industry best practices.
• Understanding of detection and response, antivirus, and other endpoint security product features to effectively use the tools to monitor security threats and to engage in endpoint investigations and incident response activities.
• Understanding of threat hunting methodologies and of various Tactics, Techniques, and Procedures used by threat actors.
• Ability to work independently and with a team in meeting organizational goals and objectives.
• Ability to manage detection and response, antivirus, and other endpoint security solutions to monitor and contain threats.
• Ability to effectively work with members of the SOC and other teams to document polices and processes, and to provide analysis reports as required.
• Ability to recognize common attack vectors such as, recon scans, botnet, malware, command, and control activity (C2), worms, trojans, and viruses.
• Ability to use correlation tools such as log aggregation tools or a SIEM for analysis.
• Knowledge in designing, implementing, administering, and troubleshooting endpoint security configurations to strengthen protections, minimize gaps, and improve endpoint client performance.
• Knowledge in client device management and vulnerability management identification and remediation.

Top 3

Skills:

• Endpoint Security
• Incident Response
• Vulnerability Management

Required Skills:

• Five years of information security experience, with a focus on Endpoint Security, Incident Response, and Vulnerability Management within an enterprise environment. The ideal candidate will have knowledge of Windows and Linux systems and their associated scripting languages, experience with AWS or Azure cloud environments, and will have worked with endpoint security platforms such as Microsoft Defender for Endpoint, Fire Eye, Crowdstrike, McAfee, or similar, and with vulnerability testing products such as Windows Defender TVM, Tenable Nessus, Rapid 7 InsightVM, Qualys, or similar.

Experience with any of the popular SIEM platforms is also desired (Splunk, Azure Sentinel, Sumo Logic, Log Rhythm, Elasticsearch, etc.)

One or more relevant technical security certifications are a plus (GIAC, ISC2, CompTIA, EC Counsel, etc.