Soc Analyst

Role purpose

Security operations and incident response

• Monitor security alerts and events using SIEM tools and investigate incidents to establish root cause and impact.
• Respond to incidents through containment, eradication, and recovery measures.
• Conduct proactive threat hunting, security assessments, and vulnerability scans.
• Maintain and configure firewalls, intrusion detection and prevention systems, and endpoint protection solutions.
• Develop and maintain incident response playbooks and procedures.
• Provide management with timely reports on security incidents and trends.
• Coordinate incident response and internal investigations, implement corrective actions, and coordinate with the National Cyber Security Agency when an incident requires it.

Security governance and risk

• Draft and maintain security policies, standards, procedures, and documentation.
• Monitor security operations procedures and information systems for potential or actual breaches and ensure identified breaches are investigated.
• Implement system changes needed to maintain security and keep security records accurate and complete.
• Assess vulnerabilities and risks for business applications and computer installations, and advise on strategies to manage risk.
• Investigate major breaches and recommend control improvements.
• Perform risk assessments, business impact analysis, and accreditation for major information systems.

Technical capabilities

• Knowledge of network and endpoint forensics, threat intelligence, applications, and underlying IT infrastructure.
• Create custom signatures or detection rules for detection and prevention technologies.
• Create customized scripts for automation and analysis.
• Develop, tune, and implement threat detection analytics, security sensors, and SOC infrastructure.

Planning and technology

• Prioritize work in consideration of team and organizational goals, and contribute to team goals, strategies, and plans.
• Assess how external changes may affect objectives and initiate appropriate responses.
• Align work plans with organizational change initiatives and evaluate achievements to guide future work.
• Select suitable technology, identify opportunities to use communications technology, and support information security and records-management compliance.

Workplace

• Work location is in person.

Requirements

• Knowledge of information and data security policies and practices, including confidentiality, integrity, and availability principles.
• Experience or capability in SIEM monitoring, incident response, and threat hunting; years of experience are not specified in the posting.
• Knowledge of security risk assessments, business impact analysis, and accreditation for major information systems.
• Knowledge of network and endpoint forensics, threat intelligence, applications, and underlying IT infrastructure.
• Ability to create custom signatures or detection rules and customized scripts for automation and analysis.
• Capability to develop, tune, and implement threat detection analytics, security sensors, and SOC infrastructure.