SOC ANALYST TIER 2/3 (Contractor)
SOC 2/3 Engineer (Remote Contractor):
General Duties -
Responsible for investigating security incidents and determining their root causes. They review incidents that have been escalated by Tier 1 analysts, who are responsible for collecting data and reviewing alerts. Tier 2/3 analysts use threat intelligence, such as indicators of compromise, TTPs, and company host system/network data sets to assess the alerts, threats and potential incidents in more depth.
General Skills -
They have deep experience with SIEM tools specifically Crowdstrike SIEM, network data, host data, Identity and Access log data, developing SIEM use cases, reducing/tuning false alerts and leading investigations until issues have been resolved. They will also monitor systems and events across different operating systems, such as Windows, macOS, and Linux.
Specific Requirements -
- Must have 5+ years recent experience as Tier 2 or 3 analyst at a large organization; government and Critical Infrastructure company preferred.
- Must have strong, demonstrated SIEM and data correlation experience
- Must have demonstrated experience designing new SOC use cases and working with vendor on implementing new use cases.
- Must have experience designing and implementing runbooks and use cases to mitigate security incidents
- Experience designing Incident Response plan, including alert definition, runbooks, escalation, etc..
- Experience documenting incident response communications for technical and management audiences
- Must have extensive experience reviewing and managing alerts in Microsoft Defender, Splunk
- Must have experience conducting hunts across disparate data sets, to include host data, vulnerability data, threat data, network data, active directory data, among others to identify threats
- Experience leading timely security operations response efforts in collaboration with stakeholders
- Must have experience setting up alert rules and effective alert management
- Demonstrated ability to create runbooks and conducting investigations with key application, IT Infra and other stakeholders
- Experience designing custom SOC SIEM use cases in Defender, Splunk and CRWD
- Experience conducting forensic work investigations
- Strong security operations documentation abilities
Attributes sought -
- Must be proactive, problem solver and curious.
- Most be a problem solver
- Must be curious
- Must be analytical, qualitative and quantitative abilities
- Must be adaptive to dynamic environment