Job Description:
Trigyn has a contractual opportunity for a Security Operations Analyst. This resource will be working Remotely.
Job Responsibilities:
The resource will be part of the 24x7 Security Operations Centre (CSOC) and will work in close collaboration with team members distributed around the globe to monitor, detect, triage, investigate and respond to cyber threats targeting client organization. They will work under the supervision and guidance of the Head of Cyber Security Operations.
Consultants working from Valencia, Spain will get Teleworking Option for up to 4 days per week.
Scope of Work / Duties of Consultant:
• Monitor and investigate alerts leveraging Microsoft Security Tools (e.g. M365, Cloud App Security, Azure, Defender for EndPoint, Azure Security, Azure Sentinel and XDR)
• Monitor and triage AWS security events and detections
• Monitor and investigate alerts leveraging EDR solutions
• Review security events that are populated in a Security Information and Event Management (SIEM) system
• Analyze a variety of network and host-based security appliance logs (Firewalls, NIDS, HIDS, Sys Logs, etc.) to determine the correct remediation actions and escalation paths for each incident
• Identify incident root cause and take proactive mitigation steps
• Assist with incident response efforts
• Follows precise analytical paths to determine the nature and extent of problems being reported by tools, e-mails, alerts, etc.
• Integrate and share information with other analysts and other teams
• Determine and direct remediation and recovery efforts
• Provide other ad hoc support as required
Required Technical Skills:
Mandatory:
• Knowledge of Transmission Control Protocol / Internet Protocol (TCP/IP) protocols
• Deep knowledge of Microsoft Security Tools (e.g. M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR
• Deep Knowledge of Cloud technologies (e.g. Azure, AWS and GCP)
• Deep knowledge of SIEM tools like Splunk, QRadar, ArcSight, MS Sentinel, ELK Stack
• Knowledge of at least one EDR solution (MS Defender for Endpoint, SentinelOne, Crowdstrike)
• Knowledge of email security, network monitoring, and incident response
• Knowledge of Linux/Mac/Windows;
• A minimum of five (5) years of relevant experience in information technology field, including triage of alerts and supporting security incidents
• Proven experience with the usual toolbox available in a SOC (e.g., SIEMs, EDRs), able to autonomously perform technical analysis of security threats and collaborate with Incident Response team
• Trouble ticket generation and processing experience
• Extensive Windows, Linux, Database, Application, Web server, etc. log analysis
• Expert knowledge of English, both written and spoken, is required
Good to have skills:
• Experience on an Incident Response team performing Tier I/II initial incident triage.
• Proven knowledge of monitoring AWS environment (Iaas, Saas, Paas)
• Knowledge of at least one general-purpose or shell scripting language (e.g. Ruby, Bash, PowerShell, Python, etc.)
Desirable certifications:
• Technical certifications: MCSE, CCNA, Microsoft Azure (e.g., SC-200), GCIH, CEH, GCFA or any GIAC/similar certification
• Relevant industry certifications
Required Soft Skills:
• Excellent communication skills
• Customer-facing experience and oral communication skills
• Ability to write documentation & reports
• Creativity/ ability to find innovative solutions
• Willingness to learn on the job
• Conflict management & cooperation
For Immediate Response, Please send your Resume to Global-Recruitment@Trigyn.com
TRIGYN TECHNOLOGIES is a multinational IT services company with resources deployed in 25 countries. TRIGYN is an ISO 9001:2015, ISO 27001:2013 (ISMS) and CMMI Level 5 certified company. TRIGYN has offices in United States, Canada, Germany Switzerland and India.