Senior Cyber Security Architect

• Monitor SIEM, trouble tickets, email notifications, in-person escalations, and logs from ICs infrastructure components including SCADA, HMI, PLC, RTU, and control servers
• Monitor applications and network devices such as switches, firewalls, and IDS/IPS
• Design, implement, and test SOAR processes and procedures
• Develop SOAR playbooks and troubleshoot automation capabilities
• Examine escalated tickets to determine true positives and false positives
• Perform malware analysis, threat hunting, and threat modeling
• Assist forensic investigations by providing reports and other information
• Review and suggest improvements to control deployment processes and installation procedures
• Develop and document remediation recommendations for business owners in an accessible manner
• Recommend and direct tuning of signatures, rules, alerts, parsers, and custom scripts
• Participate in root cause analysis and coordinate remediation
• Apply defense-in-depth strategies to client environments
• Create and disseminate security notifications for internal staff
• Act as the L2 escalation layer in the SOC
• Mentor Level 1 SOC Analysts
• Create manuals, guides, and knowledge base entries
• Stay current on security and privacy legislation, emerging threats, regulations, advisories, alerts, and vulnerabilities
• Maintain knowledge of the company’s solution portfolio and technical offerings

• 7+ years of experience in Information Technology, cybersecurity, or a related technical field
• 5+ years of experience working in a Security Operations Center (SOC), cybersecurity operations, incident response, or a related security function
• 5+ years of experience working with Security Information and Event Management (SIEM) or Security Orchestration, Automation and Response (SOAR) technologies
• 5+ years of experience developing or implementing security automation using Python, SOAR platforms, or similar technologies
• Bachelor’s degree in Computer Science, Computer Information Systems, Electronics, or a related field
• ITIL Foundation certification or a cybersecurity certification such as CompTIA Security+, GCIH, CCNA, GCFA, or CEH
• Experience with SIEM platforms and security logging solutions such as Swimlane, Sentinel, or GOOGLE SECOPS
• Candidate must be a U.S. Person: a U.S. citizen, U.S. permanent resident, protected status holder under asylum or refugee status, or someone with the ability to obtain an export authorization

Demonstrates extensive experience in Security Operations Center (SOC) functions, including monitoring and responding to security incidents, developing and implementing security automation, and conducting threat analysis. Proficient in utilizing SIEM and SOAR technologies to enhance security operations and improve incident response capabilities.

• SIEM Technologies
• SOAR Development
• Malware Analysis
• Incident Response
• Cybersecurity Certifications

• Python Programming
• Security Automation
• Threat Hunting
• Threat Modeling
• Root Cause Analysis
• Control Deployment Processes
• Remediation Recommendations
• Security Logging Solutions
• Defense-in-Depth Strategies
• Forensic Investigations

• Mentoring
• Communication
• Collaboration

• ITIL Foundation
• CompTIA Security+
• GCIH
• CCNA
• GCFA
• CEH

• Cybersecurity
• Security Operations Center
• Incident Response
• Security Information and Event Management
• Security Orchestration Automation and Response

• SCADA
• HMI
• PLC
• RTU
• Firewalls
• IDS/IPS
• Swimlane
• Sentinel
• Google Sec Ops