L2 SOC Analyst

• In this role you will be expected to analyse a range of alerts and incidents, identifying threats and attacks performed by Threat Actors ranging from cyber criminals, ATPs, and Nation States
• You will leverage various threat intelligence streams to enhance your understanding of emerging threats and vulnerabilities used by Threat Actors, providing customers with your insight and experience
• You will act as a core investigator for security incidents and alerts, escalating to senior SOC staff when a true positive has been identified
• A successful security analyst will verify security events as security incidents; correlate and collate the information; and effectively escalate their findings and recommendations internally, or to the customer
• The role requires flexibility and the ability to work as part of a wider shift pattern, additionally, there may be an on-call aspect required
• A good knowledge of Information Security is required for this role
• Proactive client services, such as compromise assessments and evaluating and recommending tools and technology for incident response are also in scope
• Demonstration of a strong comprehension of malware, emerging threats and adversary TTPs will be critical to success
• This role contributes also to the development of Operational Technology (OT) security monitoring, as part of the integration of industrial environments into our Global SOC model
• Analyse security alerts and incidents, following defined investigation processes to determine the risk they present and impact to customers
• Perform ad-hoc analysis of varied logs, identifying anomalies in customer environments
• Perform in-depth investigation on confirmed security incidents, assisting senior SOC analysts to mitigate threats
• Identify threats, perform mitigating actions to contain and eradicate threats in the environment
• Identify and document tuning opportunities for senior SOC analysts to perform
• Assist in the report creation process, performing enriching queries and investigations to help produce a high quality incident report for core stakeholders
• Assist in development of varied customer reports such as Emerging Threat reports, Incident Response reports, consistent MDR reports
• Assist in CSOC continuous improvement and development initiative to maintain and improve core processes, SOPs, and documentation
• Assist in monitoring alerts related to OT / industrial environments, following defined processes
• Support investigation of incidents involving industrial systems or OT-related activity
• Analyse anomalies in industrial network traffic or asset behavior, with guidance from senior analysts
• Contribute to incident enrichment in IT/OT convergence scenarios
• Escalate complex OT-related cases to Level 3 analysts as required
• Work in close collaboration with the Group’s OT Security Practice, leveraging their expertise for OT-related cases

Benefits

• Flexible Working Arrangements
• Career Development Opportunties
• Health Insurance
• Pension

• Large Training & Upskilling Budget

• Conceptual knowledge in Networks and Network Security
• Understanding of Network infrastructure hardware and protocols (TCP/IP, switches, bridges, routers, proxy servers, VPN concentrators)
• Ability to perform event correlation, host/ network threat analysis
• Review the adequacy of the security controls and their ability to protect the information system and its information
• Basic understanding or strong interest in Operational Technology (OT) environments
• A process of on-going certification for the benefit of the business and for self-development is encouraged
• Willingness to learn and develop skills in OT security monitoring
• Security industry certifications: SEC+, CYSA+, Net+, SC-200,AZ-500,AZ-900,Splunk Power user

• A working knowledge of Intrusion Prevention System (IPS), SIEM, SOAR & DLP is a nice to have
• Experience with Splunk is a plus
• Awareness of industrial systems such as SCADA, DCS, PLCs and HMIs
• Exposure to industrial protocols or networks is a plus
• Experience in performing analysis on network pcaps and documents for malicious activity or codes
• Understanding of basic security principles such as Confidentiality, Availability, Integrity
• Strong Microsoft Word & Microsoft Excel skills required
• Experience working with threat hunting tools is nice to have
• Experience using SIEM & IPS solutions is a plus
• Experience working with security event detection tools like IPS, SIEM, DLP, Anti-virus, etc
• Understanding of Security protocols (IPSec), and encryption technologies (3DES, AES, SHA2, TLS)
• Interest in pursuing OT-related training or certifications is encouraged
• Ability to manage multiple incidents and make effective decisions under high pressure environment
• Familiar with security best practices