Managed Services Analyst, MXDR (Night Shift)

Role overview

Schedule

• The work week is Saturday through Wednesday.
• Shift timings are 12:00 a.m. to 9:00 a.m.

Security monitoring and investigation

• Monitor intrusion detection, file integrity, endpoint protection, log management, and SIEM solutions.
• Use Microsoft Sentinel, Microsoft Defender for Endpoint, Check Point Harmony Endpoint, and other XDR solutions.
• Monitor Azure environments and analyze security events using logs and open-source intelligence.
• Distinguish legitimate activity from false-positive incidents and provide near-real-time cyber status updates.

SIEM and customer operations

• Develop and maintain environment-specific SIEM rules, alerts, dashboards, and custom queries.
• Configure SIEM tools with clients to meet security and compliance requirements.
• Handle log source configuration, data parsing, use case development, and complex managed security service issues.
• Create, follow up, and resolve customer tickets and maintain case records.

Documentation and improvement

• Prepare analytical reports, formal briefings, standard operating procedures, technical documents, training materials, and troubleshooting guides.
• Administer and maintain SIEM, log management, and data analytics platforms.
• Develop automation solutions to reduce repetitive work and improve operational efficiency.
• Provide guidance and instruction to junior SOC analysts.

Core qualifications

• Prior experience working as a SOC analyst.
• Working knowledge of SIEM and incident management solutions.
• Technical understanding of core cybersecurity technologies and emerging capabilities.
• At least 3 years of prior relevant experience.
• Strong analytical, troubleshooting, problem-solving, written communication, and verbal communication skills.

Preferred qualifications

• Experience with vulnerability management, threat hunting, SIEM tuning, alert triage, or detection engineering.
• Programming or scripting in PowerShell, Python, or Bash.
• One cybersecurity certification such as SC-900, SC-200, SC-100, Security+, CySA+, or CEH.
• Working knowledge of operating systems and fundamental networking.
• Advanced certifications such as CISSP or CISM, cloud-native security, IAM, and network security monitoring experience are advantageous.