Key Responsibilities:

• Monitor and analyze security logs to identify potential threats and suspicious activities.
• Investigate security incidents, perform initial triage, and escalate critical threats as needed.
• Utilize SIEM tools (e.g., Splunk, ArcSight, ELK) to implement and fine-tune use cases, dashboards, and alerts.
• Review security events, incidents, and alerts generated by SIEM solutions.
• Collaborate with other teams to enhance threat detection capabilities and improve incident response procedures.
• Stay updated on the latest cybersecurity threats, attack techniques, and defense strategies.

Requirements:

• Proficiency in Network+ and Security+ concepts.
• Familiarity with CEH, SANS 504, SANS 555, SANS 503, SANS 511 topics.
• Experience with SIEM tools (e.g., Splunk, ArcSight, ELK) for log analysis and alert management.
• Understanding of network security concepts, including Firewalls, UTMs, WAF, and IPS/IDS.
• Knowledge of log structures from Microsoft products, Linux, web servers, and infrastructure services.
• Basic understanding of network protocols and infrastructure services across different layers.
• Familiarity with Linux, web servers, and security devices.
• Knowledge of at least one programming language is a plus.
• Willingness to participate in on-call rotations and respond to security incidents in a timely manner.