SOC Analyst

Overview

Job Title:

SOC Analyst

Location:

Reading, United Kingdom (Hybrid- 1-2 days/week)

Job Type: Contract Inside IR35

Client:
Wipro

As an OT Senior Cyber Security Analyst, you will be responsible for maintaining Sec Ops (Security Operations) solutions, controls and processes across the organisation. You will be mentoring and assisting with leading the SOC team to ensure appropriate prioritisation and remediation of OT alerts and incidents. This role requires a deep understanding of Sec Ops concepts, technologies and best practices across IT and OT environments, as well as the ability to collaborate effectively with cross-functional teams.

The ideal candidate will possess strong communication and incident management skills and will be committed to ensuring the highest level of security, compliance, and user experience.

This job involves:

Key Responsibilities

Expectations

Contextualize OT specific threats

Responsible for understanding the Operational Technology estate, specific OT threats and controls and mitigations that are in place. To be able to use tools such as Claroty to understand network traffic and OT hardware limitations to avoid downtime due to active scans.

Understand OT specific architecture frameworks

Reduce risks with overlaying context

Build direct relationships with Operations of the essential service alongside the OT team to understand and articulate operational risk and cyber risk.

Maintain Security Operations

Responsible for maintaining our security operations processes, including supporting an effective continuous improvement process surrounding the services provided. Familiarity desired with Microsoft security operations tools (e.g. Sentinel), and extensive knowledge of other security tools such as SOAR, EDR / XDR and IDAM.

Reductions over time in repetitive tickets/alerts demonstrating successful tuning of security tooling and processes.

Reduction over time in average time it takes to investigate and resolve security incidents demonstrating an increasing efficiency in Sec Ops processes.

Operational metrics evidencing the effectiveness of security controls.

Proactive Risk Remediation

Follow a risk-based approach to continually identify, analyse and evaluate the effectiveness of security controls and relate them to appropriate (and proportionate) security controls. Responsible for helping the business to deliver new security controls and for performing proactive activities (e.g. threat hunting) to continuously evaluate and uncover vulnerabilities throughout the technology stack.

Act as an ambassador within the Cyber Security team for the application of a risk-based approach and continuous risk reduction.

Collate the data supporting dashboards with robust Sec Ops metrics that evidence the tangible reduction in risk and technical debt.

Incident Readiness & Response

The Security Operations team holds primary responsibility for cyber security incident triage, management, and response. A consistent and reliable level of service is provided around both preparing the business for a significant cyber security incident and actual responses to live incidents. Responses to incidents are run in a structured, measured and auditable manner with continuous improvement integrated into incident management processes to ensure processes are always adapting to the changing threat landscape.

Reduction over time in business impacts experienced as a result of cyber security incidents.

Time between incident identification and remediation/closure reduces over time.

The business is periodically educated on incident management procedures and readiness activities.

All staff are aware of what constitutes a cyber security incident and how it should be reported.

Continuous Improvement

Demonstrate an ability to improve processes over time whether that be increases in efficiency or using automation. The more efficient Sec Ops processes are the shorter response time to incidents will be and the more time will be available to proactive security activities such as threat hunting.

Gradual improvement over time of operational efficiencies as reporting in metrics/KPIs/dashboards.

Demonstrable use of automation to eliminate manual processes.

Qualifications, Experience, Technical Skills

Strong analytical and problem-solving abilities

Some hands-on exposure to cyber security concepts and principles

Experience in working with third party delivery partners and MSSPs

Decision making and judgement

Ability to innovate technical solutions

Excellent planning and organising capabilities

Essential Experience

Minimum of 3 years of experience working with technical Cyber Security controls, preferably in an enterprise environment

Minimum of 3 years of experience in control systems of essential service (ICS, SCADA, CNI)

Exposure to working in or with a security operations centre (SOC)

Triaging problems or issues in a structured and disciplined manner

Experience in remediating cyber risks in ever-changing digital environments

Essential Technical Skills & Qualifications

Ability to…