CSOC Threat Management Specialist – Tier 2

Responsibilities

• Identify cybersecurity problems that may require mitigating controls
• Analyze network traffic to identify exploit or intrusion‑related attempts
• Recommend detection mechanisms for exploit and intrusion attempts
• Provide subject‑matter expertise on network‑based attacks, network traffic analysis, and intrusion methodologies
• Escalate items requiring further investigation to other members of the Threat Management team
• Execute operational processes to support response efforts to identified security incidents
• Utilize AI/ML‑based tools and techniques to detect anomalies, automate incident triage, and improve threat intelligence
• Analyze threat intelligence to assess risk and adapt defenses using machine‑learning‑enhanced tools
• Manage email security with ProofPoint, monitor for threats, and promptly respond to attacks
• Configure Splunk for log analysis, create alerts, and investigate security incidents diligently
• Set up Fire Power for network monitoring, analyze traffic patterns, and enforce robust security measures
• Deploy Sentinel‑1 agents efficiently, monitor alerts closely, and conduct thorough security assessments
• Monitor, review, and respond to security alerts and incidents across multiple platforms
• Perform threat detection and analysis, investigate suspicious activity, coordinate incident response efforts, and implement remediation actions
• Tune security policies, maintain visibility into cloud and endpoint environments, and support continuous improvement of the organization’s security posture
• Stay current on the latest cybersecurity trends, threat actors, and AI/ML research relevant to the field
• Identify and support automation use cases, including the use of AI/ML to enhance SOC capabilities

• 3+ years of IT security experience with at least some exposure to AI/ML projects
• 2+ years’ experience in network traffic analysis
• BA or BS in Computer Science, Information Technology or related field
• Relevant certifications such as GIAC Certified Enterprise Defender (GCED), GIAC Certified Security Essentials (GSEC), CISSP, or SSCP desirable
• Strong working knowledge of Boolean logic, TCP/IP fundamentals, network‑level exploits, and threat management
• Knowledge of control frameworks and risk management techniques
• Excellent oral and written communication skills, as well as interpersonal and organizational skills
• Strong understanding of IDS/IPS technologies, trends, vendors, processes, and methodologies
• Strong understanding of common IDS/IPS architectures and implementations
• Strong understanding of IDS/IPS signatures, content creation, and signature characteristics including both signature‑based and anomaly‑based analysis and detection
• Experience with cloud security (AWS, Azure, GCP)
• Hands‑on experience with cybersecurity automation (e.g., SOAR platforms)
• Proficiency in using machine‑learning frameworks to develop, train, and deploy models for anomaly detection, threat intelligence, and behavioral analysis in cybersecurity contexts

Demonstrates expertise in cybersecurity problem identification, network traffic analysis, and incident response, utilizing AI/ML tools for threat detection and automation. Proficient in managing security incidents and enhancing organizational security posture through continuous improvement and risk management techniques.