THE ROLE: Security Operations Analyst (Tier 1)



Job Summary:



The Security Operations Centre (SOC) Analyst assists in analysing P1/P2/P3 alerts triggered by the SOC monitoring tools and to participate in the maintenance and tuning of these tools. The SOC analyst will function as a Tier 1 analyst, and act as the entry point for security incidents triage and analysis and customer requests. The Tier 1 SOC analyst will review security incident as per internal processes and escalate to the Tier 2 analyst as required. He will work with other analysts to collect, correlate, and analyse security-relevant data, and respond to threats in a timely manner.



Job Responsibilities:

• Work with the other Tier 1 SOC Analysts, to perform analysis and triage of security incidents and threat activity


• Provide support and cooperate with other members of the SOC team


• Be responsible to manage his time and the assigned tasks


• Regularly and promptly carry out the ticket management tasks


• Monitor the security ticket dashboard to make sure that customer SLA are not breached


• Staying up to date with emerging security threats


• Communicate effectively with customers, teammates, and management


• Monitoring and management of SIEM infrastructure


• Monitor the service ticket board and ensure the tickets are managed and responded in line with SLA


• Escalate false positive incidents to L2 Analyst for fine tuning


• Provide feedback to help automating common recurring tasks


• Create monthly customer reports


• Review vulnerability scans results

• Requires background in at least 2 of the following domains: ethical hacking, incident response, forensic analysis, security engineering, incident analysis and investigations


• At least 1 years' experience in managing working in Security Operations Centre with a Security Incident & Event Management (SIEM)


• Experience on SIEM technology, preferably on Microsoft Sentinel


• Experience in incident analysis, detection and response


• Knowledge of network and server security products, technologies, and protocols


• Knowledge of security devices such as Firewall, IPS/IDS, Web proxy


• Good OS knowledge such as Windows and Linux


• Security certifications (CompTIA Security+, CEH, Microsoft SC-200) preferred