SOC Thread Specialist

Overview

Protect the organization’s Information Technology (IT) and Operational Technology (OT) environments by detecting, investigating, and proactively hunting for cyber threats, while bridging intelligence and operations to transform threat data into actionable detections and hunting activities. Work with the SOC team to enhance and strengthen the organization’s overall cyber defense resilience and composure.

• Perform proactive threat hunting across IT and OT networks using intelligence from the Threat Analysts to uncover stealthy or undetected threats.
• Analyse and correlate security incidents to understand attacker behaviour, techniques, and campaign patterns beyond simple alerts.
• Bridge threat intelligence with detection logic, translating new Indicators of Compromise (IOCs), Tactics, Techniques, and Procedures (TTPs), and adversary trends into actionable detection content for the SOC Engineers to implement.
• Conduct deep-dive investigations on high-severity alerts, ensuring accurate root cause determination and actionable recommendations. Prepare technical briefing reports summarizing threat findings and lessons learned for management.
• Support incident response teams during containment and eradication phases by providing context on attacker tools, tactics, and infrastructure.
• Collaborate with the SOC Engineers to refine Security Information and Event Management (SIEM) use cases, detection rules, and Security Orchestration, Automation, and Response (SOAR) playbooks based on threat hunting outcomes.
• Perform malware reverse engineering and behavioural analysis, extracting Indicators of Compromise (IOCs), YARA rules, and technical findings to feed into threat hunting and detection development.
• Develop and maintain threat profiles for key adversaries and attack scenarios targeting both IT and OT environments.
• Continuously improve analytical techniques, staying current with emerging threats, tools, and frameworks such as MITRE ATT&CK.
• Ensure alignment with legal and ethical guidelines to ensure team activities are authorized and do not compromise the company’s integrity or reputation.

• Bachelor’s degree in information security, computer science, or engineering.
• Professional certification such as GCTI, GCIA, GCIH, or GREM.
• 10 years of information security experience in a similar position.
• Proven experience in cyber threat analysis, hunting, and incident investigation across both IT and OT environments.
• Strong understanding of network protocols, malware behaviour, and adversary TTPs aligned with the MITRE ATT&CK framework.
• Experience with SIEM/SOAR platforms, threat intelligence tools, and log analysis for advanced threat detection.
• Strong analytical and investigative skills with hands‑on experience in threat hunting.
• Practical knowledge of malware reverse engineering, static/dynamic analysis tools (e.g., Ghidra, IDA Pro, or x64dbg), and IOC extraction.

• Ability to assess and evaluate risk and the impact of legislation and actively promotes compliance.
• Possesses a good understanding of IT and OT business applications.
• Effective and persuasive in both written and oral communication.