SOC L2 Analyst

Job Description

Our ClientLeading US-based technology company.Your Responsibilities

• Provide initial investigation of security incidents escalated from the SOC L1 Function
• Check for false positive & duplicates
• Provide communication and escalation throughout the incident per the CSIRT guidelines
• Communicates directly with data asset owners and business response plan owners during high severity incidents
• Hunting for suspicious anomalous activity based on data alerts or data outputs from various toolsets
• Perform analysis of log files to collect more contextual information in order to triage the security threat
• Provide first responder forensics analysis and investigation
• Drives containment strategy during data loss or breach events
• Triage and resolve advanced vector attacks such as botnets and advanced persistent threats (APTs)
• Works directly with data asset owners and business response plan owners during high severity incidents
• Provide tuning recommendations to administrators based on findings during investigations or threat information reviews
• Collect contextual information and pursue technical root cause analysis and attack method analysis
• Make content determination to treat the alert as a security incident and assign a severity level
• Close or escalate the security incident to the SOC L3 Function
• In certain cases, the alert/incident can be returned to SOC L1 Function with feedback and suggestions
• The resource must have extensive experience in incident handling and reporting (at least 3 years in a similar role).
• The resources must be certified on the proposed SIEM / IRP solution

Your Qualifications

• Strong Analytical and Problem Solving Skills
• Knowledge of network security zones, Firewall configurations, IDS policies
• Knowledge of systems communications from Layer 1 to 7
• Experience with Systems Administration, Middleware, and Application Administration
• Experience with Network and Network Security tools administration
• Knowledge of log formats and ability to aggregate and parse log data for syslog, http logs, DB logs for investigation purposes
• In-depth experience with log search tools such as ArcSight/Splunk, usage of regular expressions and natural language/AQL queries
• In-depth knowledge of packet capture and analysis
• Experience with Security Assessment tools (NMAP, Nessus, Metasploit, Netcat
• Ability to make create a containment strategy and execute
• Security Essentials - SEC401 (optional GSEC certification)
• Intrusion Detection In Depth - SEC503 (optional GCIA certification)
• Hacker Techniques, Exploits & Incident Handling - SEC504 (optional GCIH certification)
• OSCP - Pen test With Kali

Halian GroupWith over 20 years of experience, we have come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers.Our resourcing and smart services help you to realize tomorrows potential. Discover the amazing things possible when you bring the right people and the right technologies together.#LI-SD1

Keyskills :

About Company

Award-Winning Tech Talent Company. We help businesses make progress, build efficiency and discover new possibilities. Our goal is to support talented individuals to explore, innovate and unleash their potential.Our success has spanned over 20 years. In that time, we’ve come to understand that innovation is the only way to provide agile, practical solutions that transform businesses and careers that fulfil potential, faster.Halians smart services, tech talent and search capability, help you to realise tomorrow’s potential. To discover the amazing things that are possible when you bring the right people and the right technology together.