SOC Lead
Requirements & Responsibilities:
1. Lead the monitoring and analysis of security alerts and events from multiple sources to identify and respond to potential security incidents.
2. Provide mentorship and guidance to junior analysts, sharing your knowledge and expertise to help develop their skills.
3. Conduct thorough analysis of security incidents, assessing their impact and coordinating cross-functional efforts for effective resolution.
4. Develop and implement advanced detection rules, use cases, and correlation logic to enhance the accuracy of security monitoring.
5. Collaborate with threat intelligence teams to stay informed about the latest threats, tactics, techniques, and procedures (TTPs).
6. Lead incident response efforts, ensuring swift and comprehensive actions to contain, eradicate, and recover from security incidents.
7. Participate in post-incident reviews and analysis to identify root causes and areas for improvement.
8. Contribute to the continuous improvement of SOC processes, procedures, and toolsets.
9. Stay updated with emerging security technologies and industry trends to make recommendations for tool upgrades and process enhancements.
10. Assist in the creation and maintenance of comprehensive documentation related to security incidents, procedures, and findings.
11. Review incidents escalated by Level 1 analysts
12. willing to work in a 24-hour, seven-day-a-week rotational shift model, including night shift
13. Coordination with internal customers for their security-related problems and providing solutions
14. Forensic investigation
Good to Have:
1. Strong expertise in security monitoring tools and technologies, such as SIEM, Firewall IDS/IPS, EDR, threat intelligence platforms including log source integrations, custom parsers built, fine tuning and optimizing the correlation rules, and use cases Is MUST
2. In-depth understanding of network protocols, firewall technologies, endpoint security, and cloud security.
3. Recognize successful intrusions and compromises by reviewing and analysing relevant event detail data.
4. Proven experience in leading and managing security incident response efforts.
5. Excellent analytical and problem-solving skills, with the ability to dissect complex security incidents.
6. Exceptional communication and interpersonal skills for effective collaboration with technical and non-technical stakeholders.
7. Relevant certifications (e.g., CISSP, CISM, CISA, GIAC Certified Incident Handler, CEH Certified, CCSP, SOC Analyst) are highly desirable.
Qualification:
Bachelor's degree in Computer Science, Information Security, or a related field is preferred.