L3 SOC Analyst

• Strong L3 SOC / Security Operations experience within a commercial environment.
• Proven experience with SIEM onboarding, configuration, tuning, optimisation and use-case development.
• Strong Security Monitoring, Incident Response and Threat Intelligence experience.
• Experience performing advanced event and incident analysis, including baseline and trend analysis.
• Commercial experience in Penetration Testing and/or Security Monitoring.
• Experience providing technical leadership, mentoring and guidance to L2/L3 SOC analysts.
• Strong understanding of networking, infrastructure, operating systems and security architecture.
• Experience across Windows, Linux and/or Mac system administration.
• Experience supporting Major Incident Response, including threat identification, containment and remediation.
• Ability to communicate complex security issues effectively to technical and non-technical stakeholders.
• Active SC Clearance or ability to obtain SC Clearance.

• SIEM:
  Microsoft Sentinel, IBM QRadar, Log Rhythm
• Microsoft Security:
  Microsoft Defender for Endpoint, Microsoft Defender for Identity and Cloud
• Microsoft Sentinel: KQL, use-case development, detection rules, workbooks, playbooks
• SOAR:
  Logic Apps and security automation
• MSSP / Multi-Tenant:
  Microsoft Sentinel Lighthouse, multi-customer environments and Dev Ops
• Threat Intelligence:
  Open-source and commercial intelligence
• Security Monitoring:
  Alert analysis, detection engineering, rule creation, tuning and optimisation
• Incident Response:
  Advanced investigation, containment, remediation and Major Incident Response
• Infrastructure:
  Networking, operating systems and infrastructure design
• Log Management:
  Log-source assessment, parsing, onboarding and monitoring
• Automation: SOAR, playbook development and process improvement

Relevant industry certifications are highly desirable, including:

• CompTIA Network+
• CompTIA Security+
• CompTIA CySA+
• CISMP
• CISSP
• Other relevant SOC, SIEM, Cyber Security or Protective Monitoring certifications

Must hold UK, EU or Irish passport – Must be in Belfast – this is a hybrid role 2 days per week