Задачи
•Monitor and analyze logs and alerts from firewalls, IDS/IPS, endpoints, servers, and cloud platforms
•Correlate events from multiple sources to identify advanced threats and unusual behavior patterns
•Fine-tune alert thresholds and detection logic to reduce false positives and improve signal-to-noise ratio
•Maintain dashboards and reporting for real-time visibility into security posture
•Respond to security incidents throughout detection, containment, eradication, recovery, and lessons learned
•Coordinate with internal stakeholders and external vendors during high-severity incidents or data breaches
•Perform root cause analysis and forensic investigations using endpoint and network-based artifacts
•Maintain detailed incident documentation and contribute to post-mortem analysis and reports
•Research emerging threats and trends
•Create and tune detection rules, threat-hunting queries, and use cases across multiple platforms, including cloud environments
•Maintain the CTI Platform and integrate CTI feeds with security controls for active CTI-driven detections
•Communicate with IT, DevOps, Risk, and Compliance teams during incidents and investigations
•Provide concise updates during incident handling to stakeholders and management
•Mentor junior analysts and assist with SOC training efforts
Требования
•2–3 Years of experience in a SOC or cybersecurity operations role, ideally in a fast-paced fintech or enterprise environment
•Strong knowledge of security best practices, including incident handling, alert triage, log analysis, and threat modeling
•Understanding of online technologies, REST APIs, microservices, and modern application architectures
•Experience working in a culturally diverse and collaborative environment
•Familiarity with DLP, AV, and anti-malware systems from an operational monitoring perspective
•Experience with phishing detection, user behavior analytics, and security awareness campaigns
•Strong communication skills for coordinating incident response and writing clear incident reports
•Experience with SIEM platforms, SOAR tools, EDR/XDR, and Threat Intelligence platforms
•Familiarity with cloud environments and cloud-native logging and monitoring tools
•Scripting experience, such as Python, to automate tasks and improve SOC efficiency
Nice to have: Security+, CySA+, eCIR, eCTHPv2, GCIA, or GMON certifications.
Условия
No conditions specified
