L3-SOC ANALYST

Experience:5-8 years minimum

Job Location: Benagluru

Key Responsibilities Of The Job

Level 3 is responsible for the development and maturity of the forensic and investigations program within the organization. He performs a variety of highly technical analyses and procedures dealing with the collection, processing, preservation, analysis, and presentation of computer related evidence.

Primarily responsible for the administration, apps & infrastructure, playbooks, azure functions, Defender detections rules, architecture, configuration, and analytic performance. The level 3 analyst also develops, implements, and executes standard procedures for the front-end operation within Security Operations Center. You will also communicate with the SOC manager and analysts to optimize the detection (analytics) performance to better meet the needs of the SOC.

Additional Responsibilities Include

• Conduct forensics analysis on systems and ensure root cause and resolution for metrics, tracking and lessons learned are compiled, documented, and disseminated.
• Use of forensic tools and investigative methods to find specific electronic data, including internet use history, processing documents, images, and other files.
• Responsible for disseminating and reporting cyber-related activities, conducting vulnerability analyses, conducting risk management of computer systems
• Analyse and review escalated cases until closure, this includes investigating and recommending appropriate corrective actions for data security incidents which includes communicating with the implementation staff responsible.
• Perform forensic analysis on logs, traffic flows, and other activities to identify malicious activity.
• Research, develop, and keep abreast of testing tools, techniques, and process improvements in support of security event detection and incident response.
• Reverse engineer and analyse binaries, files, and other malicious attack artifacts.
• Establish, maintain, and ensure complete chain of custody of forensic evidence.
• Analyst level 3 writes up technical reports detailing how the computer evidence was discovered and all the steps taken during the retrieval process.
• The analyst also gives testimony regarding the evidence he or she collected. The analyst keeps current on new methodologies and forensic technology.
• This expert is not only proficient in the latest forensic response and reverse engineering skills but is astute in the latest exploit methodologies.
• Will provide significant input into the design and development of the organizations working information security systems operations and maintain strategy and methodology to comply with the organization's cyber security standards and mission.
• On-call duty
  
  

Other Duties Include

• Capacity planning (Long-term/Short-term storage logs)
• Change management (Analytic detections/Workbooks/Playbooks/Notebooks versioning)
• Patch management (Security tooling: Nessus, MISP, rsyslog, Zscaler NSS)
• Tune and optimize Azure Sentinel KQL performance and event data quality to maximize Azure Sentinel and Microsoft Defender efficiency and assists with data source correlation using Azure Sentinel and Microsoft Defender. Additionally, the level3 is responsible to ensure all Azure Sentinel components perform as expected meeting established service level objectives for optimal system uptime.
  
  

Interfaces

• Group IS&T department: EUSS, IT, Front & Back Office
• Affiliates IS&T, asset owners
• IT Project managers
• Technical Direction & related technical teams
• SOC team
  
  

Education/ Experiences/ Skills/ Competencies Required

• Framework MITRE ATT&CK,
• Attack technique/APT,
• Monitoring, research, analysis, and response to alerts,
• Creation and implementation of use cases,
• SIEM Microsoft Sentinel,
• Principles and methods of investigation (Chain of custody, ...)
• General knowledge in cybersecurity (vulnerabilities, cryptography, state of the art and best practices, ...)
• Advanced knowledge of log management and analysis of all types (syslog, windows, applications, ...)
  
  

Core Skills

• Excellent time and priority management.
• Ability to work in an international context.
• Ability to analyse and synthesise
• Experience of working in a dynamic environment and ability to multi-task
• Autonomy and initiative (ability to seek, find and implement a solution)
• Resistant to stress.
• Critical Thinking,
• Unquenchable curiosity,