安全运营中心（SOC）分析师
Security Operations Center (SOC) Analyst
职位概述：
作为 viLogics 的 SOC 分析师，您是位于 Total Secure Office 365（TSO 365）框架内的前线网络安全防御者——这是我们全托管的网络安全和 IT 服务平臺。在 MSSP（托管安全服务提供商）环境中，您将与精英工程师合作，为来自医疗、教育、制造和州/地方政府等行业的客户提供持续威胁检测、事件响应和风险缓解服务。
此职位需要深入的分析能力、协作意识以及对云、混合和本地环境的操作熟练度。分析师必须熟悉 viLogics 的专有 FastTrack 网络安全模型，该模型包括完全集成的 MDR/XDR、SIEM、SASE、PAM 和安全备份平台。
核心职责：
🔍 安全监控与威胁检测
- 通过 viLogics 集成的 MDR/XDR 平台监控终端、服务器、SaaS 平台（如 M365）和云工作负载。
- 分析 viLogics 的 SIEM/SOAR 环境中的事件，并根据严重程度和工作流程进行升级。
- 应用威胁情报数据源、MITRE ATT&CK 映射和行为分析来检测高级持续性威胁（APTs）、勒索软件和零日漏洞。
⚠️ 事件分类与响应
- 使用 viLogics 的 TSO 工具包对 Tier 1 和 Tier 2 安全事件进行实时响应，包括基于剧本的 SOAR 工作流。
- 编写事件报告并进行影响评估和建议的缓解措施；与客户 IT 团队或 viLogics 的 Helpdesk 协调修复工作。
- 参与事件后回顾，确保记录经验教训并将其应用于事件响应剧本中。
🛠️ 运营卓越与自动化
- 调整关联规则、检测逻辑和警报阈值，以符合客户的风险概况和合规要求（如 HIPAA、CMMC、PCI 等）。
- 建议改进自动化隔离工作流（如隔离主机、撤销凭证等）。
- 协助 viLogics 网络安全准备活动中开展的紫队演练和桌面推演。
🧩 客户协作
- 参与每月客户简报，审查检测到的威胁、趋势和安全态势改进情况。
- 在客户会议和合规审计中将复杂的技术发现转化为高层管理见解。
- 利用 viLogics 的网络暴露指数和 SaaS 警报工具为客户优先排序风险。
查看英文原文
Position Overview:
As a SOC Analyst at viLogics, you are a front-line cyber defender operating within the Total Secure Office 365 (TSO 365) framework—our fully managed cybersecurity and IT services platform. In this MSSP (Managed Security Services Provider) environment, you will work alongside elite engineers to deliver continuous threat detection, incident response, and risk mitigation for our clients, across industries ranging from healthcare and education to manufacturing and state/local government.
This role requires deep analytical skills, collaborative instincts, and operational fluency in cloud, hybrid, and on-prem environments. Analysts must be comfortable supporting viLogics’ proprietary FastTrack Cybersecurity Model, which includes fully integrated MDR/XDR, SIEM, SASE, PAM, and secure backup platforms.
Core Responsibilities:
🔍 Security Monitoring & Threat Detection
- Monitor endpoints, servers, SaaS platforms (e.g., M365), and cloud workloads via viLogics integrated MDR/XDR platform.
- Analyze events from viLogics' SIEM/SOAR environment and escalate based on criticality and workflows.
- Apply threat intelligence feeds, MITRE ATT&CK mapping, and behavioral analytics to detect advanced persistent threats (APTs), ransomware, and zero-day exploits.
⚠️ Incident Triage & Response
- Lead real-time response to Tier 1 and Tier 2 security events using viLogics' TSO toolkits, including playbook-driven SOAR workflows.
- Document incident reports with impact assessments and recommended mitigations; coordinate remediation with client IT teams or viLogics’ Helpdesk.
- Participate in post-incident reviews, ensuring lessons learned are documented and improvements applied to IR playbooks.
🛠️ Operational Excellence & Automation
- Tune correlation rules, detection logic, and alert thresholds to align with client risk profiles and compliance requirements (HIPAA, CMMC, PCI, etc.).
- Recommend improvements for automated containment workflows (quarantining hosts, revoking credentials, etc.).
- Assist with purple team exercises and tabletop simulations facilitated under viLogics’ cyber readiness engagements.
🧩 Client-Facing Collaboration
- Participate in monthly client briefings to review detected threats, trends, and security posture improvements.
- Translate complex technical findings into executive-level insights during client calls and compliance audits.
- Provide risk prioritization to clients leveraging viLogics’ Cyber Exposure Index and SaaS Alert integrations.
Toolsets You’ll Work With:
- SIEM/SOAR: viLogics Internal SIEM/SOAR, Microsoft Sentinel, Splunk, LogRhythm, Cortex XSOAR
- EDR/XDR/MDR: viLogics EDR, SentinelOne, Defender for Endpoint, Huntress, CrowdStrike (client-dependent)
- IAM/PAM: ThreatLocker, Microsoft Entra ID (Azure AD), Duo
- Network Security: DNS Filtering, ZTNA, SASE Netskope, Prisma Access)
- Backup & DR: Veeam, Zerto, Rubrik, Air-Gap Immutable Storage
- Compliance Integrations: CISv8, NIST 800-171, HIPAA, CMMC 2.0, PCI-DSS
Required Qualifications:
- 1–3 years in a SOC, MSSP, or threat analyst role
- Strong understanding of TCP/IP, DNS, HTTP/S, and log analysis
- Familiarity with MITRE ATT&CK, threat intelligence platforms, and TTP correlation
- Hands-on experience with at least one SIEM, one EDR/XDR platform, and identity protection tools
- Solid knowledge of Microsoft 365 workloads, including Defender for Office, Teams, OneDrive, and SharePoint
Preferred Certifications:
- CompTIA Security+ or CySA+
- Microsoft SC-200: Security Operations Analyst
- GIAC Certified Detection Analyst (GCDA)
- EC-Council CSA / CEH
- Kaseya One certifications
- SentinelOne or CrowdStrike analyst certifications
What Sets This Role Apart at viLogics:
✅ Work inside a Tier-3 SOC 2 Certified Data Center
✅ Help clients qualify for $1.5M+ in bundled cybersecurity insurance
✅ Operate in a Zero Trust Architecture (ZTA) environment with integrated SASE, SD-WAN, and PAM
✅ Be part of a team that blends ITIL-based service delivery with cyber warfare-level response protocols
Career Trajectory:
- Tier 2 / Tier 3 SOC Analyst
- Cyber Threat Hunter
- vCISO or Compliance Officer
- DFIR Specialist or Security Engineer
- TSO 365 Platform Architect
Work Environment:
- Fully remote with optional travel to client locations or viLogics Data Centers
- Rotational 24/7 coverage schedule with premium for overnight/weekend shifts
- Collaborative, fast-paced security operations team focused on measurable impact and client security maturity
Originally posted on Himalayas