SOC分析师 I - 菲律宾
SOC Analyst I - Philippines
职位概述 本职位在数字马尔斯特朗网络安全组织内。候选人负责监控客户环境中的运营或安全事件及时检测和升级。他们将与其他工程师，主要顾问以及各类客户联系人 （如利益相关者，建筑师，业务分析师和管理）密切合作。职责 ·收集，编译和合成有关技术和流程的信息。·必须具备强大的个人间沟通技能。• 具有能力：·能够有效地与客户合作，同时平衡业务挑战的需求：保密性，诚信和可用性。·有能力与多个受众合作并将技术信息转化为非技术信息。·致力于促进多样化的工作环境。·能不断提高对业务和技术任务相关的自己的技能集体，并监督。必须主动，与项目管理协商，并在计划中成功执行。·能够参与敏捷团队实践；诚实反映自身绩效，参与共享团队责任，建议改进团队改善。· 必须能够根据公司的政策进行适当的裁量处理敏感信息 · 向客户和内部利益相关者提供频繁的状态更新 · 对网络威胁，漏洞或攻击迹象以及升级数据审查日志和其他安全事件数据 · 与高级工程师合作测试安全姿势或配置的复杂和详细方面，确定缺陷并建议修复行动 · 与高级技术人员一起工作作为正常安全实践的一部分编写手动和自动化测试。· 根据记录的标准操作程序运行 SOC （安全运营中心）技术，包括但不限于安全信息事件管理 (SIEM),侵入检测系统 (IDS),防火墙，反恶意软件解决方案和内部威胁软件 · 为 SOC 班级经理准备分配的报告 · 根据需要提供高质量的书面和口头报告 · 建议新的警报规则和逻辑来发现有趣事件以获得安全分析师批准 ·协助设计，编写和执行安全意识计划 · 参加基于风险的项目
查看英文原文
This is a remote position.
Position Overview
This position is within the cybersecurity organization at Digital Maelstrom. Candidates are responsible for the timely detection and escalation of operational or security events in monitored client environments. They will work closely with other engineers, principal consultants, and various client contacts such as stakeholders, architects, business analysts and management.
Duties
- Gather, compile, and synthesize information regarding technology and processes.
- Must possess strong interpersonal and communications skills
- Ability to work effectively with customers to solve business challenges while balancing the need for confidentiality, integrity, and availability.
- Proven ability to work with diverse audiences and translate technical information into non-technical information.
- Commitment to fostering a diverse working environment.
- Be capable of continually improving one’s own skill set relevant to business and technical missions with oversight. Must take initiative, negotiate with project management, and execute successfully on plans.
- Able to participate in agile team practices; reflect honestly on own performance, participate in shared team accountability, recommend changes for team improvement
- Must be able to handle sensitive information with appropriate discretion according to company policies
- Provide frequent status updates to clients and internal stakeholders
- Review logs and other security event data for signs of cyber threats, vulnerabilities, or attacks and escalate to senior engineers
- Work with senior engineers to test complicated and detailed aspects of a security posture or configuration, identify deficiencies, and recommend remediation actions
- Work with senior engineers to write manual and automated tests as part of a normal security practice.
- Operate SOC (Security Operations Center) technologies according to documented standard operating procedures, including but not limited to a Security Information Event Management (SIEM) platform, Intrusion Detection Systems (IDS), Firewalls, Anti-Malware solutions, and insider threat software
- Prepare assigned reports for the SOC shift manager
- Provide high quality written and verbal reports as required
- Recommend new alert rules and logic to detect events of interest for approval by security analysts
- Assist in the design, documentation, and execution of security awareness programs
- Participate in risk-based analysis of security controls and requirements
- Provide technical assistance to other IT (Information Technology) functions with regards to security objectives and requirements
- Monitor, triage, and respond to helpdesk calls, operational alerts, and tickets for clients as a first point of contact
- Responsible for managing helpdesk ticket intake queues and responding to requests
- Respond and escalate when appropriate to alerts, events, and requests with appropriate urgency
- Assist clients with technical support needs
- Manage personal tasks and prioritization including actions for ticket queues, scheduling, and communications to clients and stakeholders
- Other duties as assigned.
Requirements
Required Qualifications
- Familiar and efficientincomputer skillsto communicate remotely, author documents & reports,and organize work
- Ableto identify criticalIT operational or securityissues quickly and accurately
- Experience supporting,using, and investigatingissues onWindows, Linux, macOS platforms
- Understandsnetworking fundamentals, protocols & application behaviors as related to security matters
- Self-motivated, detail-oriented,methodical, and organized to accomplish assigned tasks
Preferred Qualifications
- A solid understanding of best practices and techniques in attacking or defending information systems
- Have experience with detection and SIEM tools and techniques (Sigma, Elastic Security, Microsoft Defenderfor Endpoint,etc.)
- Experience with Command-line Interfaces, Shells and Shell scripting
- Experience with Microsoft 365
- Experience with secure configuration and implementation of systems
- Cloud experience (any of AWS (Amazon Web Services), Azure, Google Cloud)
- Bachelor’s Degree in Computer Science, Information Systems, or related field; or certification in relevant programs (CISSP, CSSLP, OSCP, GPEN, GIAC,CompTIA A+, Network+, Security+, or others); or equivalent work experience
Originally posted on Himalayas