SOC 2 分析师
SOC 2 Analyst
SOC 2 合同
至 2026 年
支持亚太时区
负责调查安全事件并确定根本原因。他们审查由一级分析师升级的事件，这些分析师负责收集数据和查看警报。二级/三级分析师使用威胁情报，如入侵指标、战术技术程序以及公司主机系统/网络数据集，对警报、威胁和潜在事件进行更深入的评估。
他们对 SIEM 工具有深入了解，特别是 Crowdstrike SIEM，网络数据、主机数据、身份和访问日志数据，开发 SIEM 使用案例，减少/调整误报，并领导调查直至问题解决。他们还会在不同操作系统（如 Windows、macOS 和 Linux）上监控系统和事件。
必须积极主动，善于解决问题且充满好奇心。
必须在大型组织中拥有 5 年以上二级或三级分析师经验；政府和关键基础设施公司优先。
必须具备强大的、可证明的 SIEM 和数据关联经验。
必须有设计新 SOC 使用案例并与供应商合作实施新使用案例的实操经验。
必须有设计和实施运行手册和使用案例以缓解安全事件的经验。
有设计事件响应计划的经验，包括警报定义、运行手册、升级流程等。
必须有在 Microsoft Defender、Splunk 和或 Crowdstrike 中审查和管理警报的丰富经验。
必须有跨不同数据集（包括主机数据、漏洞数据、威胁数据、网络数据、活动目录数据等）进行狩猎的经验，以识别威胁。
有与利益相关者协作及时开展安全运营响应工作的经验。
有为技术及管理层受众记录事件响应沟通的经验。
必须有设置警报规则和有效警报管理的经验。
有创建运行手册并与其他关键应用、IT 基础设施和其他利益相关者进行调查的能力。
有在 Defender、Splunk 和 CRWD 中设计自定义 SOC SIEM 使用案例的经验。
有进行取证调查工作的经验。
必须是善于解决问题的人。
必须充满好奇心。
必须具备分析能力，有定性和定量分析能力。
必须能够适应动态环境。
具备强大的安全运营文档编写能力。
最初发布于 Himalayas
查看英文原文
SOC 2 Contract
Through 2026
Supporting APAC Time zones
Responsible for investigating security incidents and determining their root causes. They review incidents that have been escalated by Tier 1 analysts, who are responsible for collecting data and reviewing alerts. Tier 2/3 analysts use threat intelligence, such as indicators of compromise , TTPs, and company host system/network data sets to assess the alerts, threats and potential incidents in more depth.
They have deep experience with SIEM tools specifically Crowdstrike SIEM, network data, host data, Identity and Access log data, developing SIEM use cases, reducing/tuning false alerts and leading investigations until issues have been resolved. They will also monitor systems and events across different operating systems, such as Windows, macOS, and Linux.
Must be proactive, problem solver and curious.
Must have 5+ years recent experience as Tier 2 or 3 analyst at a large organization; government and Critical Infrastructure company preferred.
Must have strong, demonstrated SIEM and data correlation experience
Must have demonstrated experience designing new SOC use cases and working with vendor on implementing new use cases.
Must have experience designing and implementing runbooks and use cases to mitigate security incidents
Experience designing Incident Response plan, including alert definition, runbooks, escalation, etc..
Must have extensive experience reviewing and managing alerts in Microsoft Defender, Splunk and or Crowdstrike
Must have experience conducting hunts across disparate data sets, to include host data, vulnerability data, threat data, network data, active directory data, among others to identify threats
Experience leading timely security operations response efforts in collaboration with stakeholders
Experience documenting incident response communications for technical and management audiences
Must have experience setting up alert rules and effective alert management
Demonstrated ability to create runbooks and conducting investigations with key application, IT Infra and other stakeholders
Experience designing custom SOC SIEM use cases in Defender, Splunk and CRWD
Experience conducting forensic work investigations
Most be a problem solver
Must be curious
Must be analytical, qualitative and quantitative abilities
Must be adaptive to dynamic environment
Strong security operations documentation abilities
Originally posted on Himalayas