Job Description:
Trigyn has a contractual opportunity for a Security Operations Analyst (SIEM Operations and Threat Detection). This resource will be working remotely.
Required Profile:
The incumbent will be part of the Cybersecurity Operations Section (CSO) to provide front line support to clients Partners in the area of information/cyber security, risk management consulting, and security operations activities in collaboration with a team of information and cyber security experts. The resource will be part of the Security Operations Centre (CSOC) and will work in close collaboration with team members distributed around the globe to support the operation, enhancement, and optimization of security monitoring and threat detection platforms protecting client or its Clients, and Partner Organizations.
Within the different activities performed by the CSOC team, the resource will focus primarily on activities supporting threat detection and cybersecurity operations capabilities, including security content management, validation and quality assurance activities, detection use case lifecycle management, onboarding and integration of security data sources, reporting, process optimization, and the continuous improvement of security monitoring and detection services across multiple customer environments.
Scope of Work / Duties of Consultant:
Reporting to the CSOC Team Lead, the incumbent will conduct the following duties and deliverables:
• Contribute to the development, implementation, validation, tuning, and maintenance of security monitoring, analytics, and detection capabilities across SIEM, EDR, cloud, and other cybersecurity platforms.
• Support the operation, maintenance, optimization, and continuous improvement of security monitoring and threat detection services.
• Participate in the onboarding, integration, testing, and validation of security data sources, telemetry feeds, and monitoring capabilities.
• Contribute to security content management activities, including use case lifecycle management, rule reviews, testing, tuning, and content quality assurance.
• Collaborate with cyber threat intelligence, incident response, and cybersecurity operations teams to translate operational and threat intelligence requirements into effective detection and monitoring capabilities.
• Under guidance, participate in cybersecurity architecture reviews of new or existing solutions and provide recommendations to enhance security monitoring and detection effectiveness.
• Contribute to the preparation and maintenance of cybersecurity operations metrics, dashboards, KPIs, and service performance reports.
• Review, validate, and assess the effectiveness of detections, monitoring configurations, operational processes, and service deliverables, identifying opportunities for improvement.
• Gather and analyze operational feedback to identify opportunities for tuning, optimization, reduction of false positives, and improvement of overall detection quality.
• Contribute to quality assurance activities, including process reviews, control validation, service quality assessments, and implementation of corrective actions.
• Support the development, review, and maintenance of CSOC procedures, standards, documentation, knowledge base articles, and operational guidance materials.
• Prepare and present technical reports, summaries, findings, and recommendations to internal and external stakeholders.
• Provide other ad hoc support as required Required Technical Skills:
The resource MUST have the following skills and experience:
• A minimum of five (5) years of relevant experience in information technology field, including triage of alerts and supporting security incidents
• Proven experience on administering a SIEM platform, preferably either Splunk or Microsoft Sentinel SIEM
• Proven experience with the usual toolbox available in a SOC (e.g., SIEMs, EDRs) and being able to autonomously perform technical analysis of security threats and collaborate with Incident Response team
• Deep knowledge of Microsoft Security Tools (e.g. M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR
• Deep Knowledge of Cloud technologies (e.g. Azure, AWS and GCP)
• Deep knowledge of SIEM tools like Splunk, QRadar, ArcSight, MS Sentinel, ELK Stack
• Knowledge of at least one EDR solution (MS Defender for Endpoint, CrowdStrike)
• Knowledge of email security, network monitoring, and incident response
• Knowledge of Linux/Mac/Windows
• Expert knowledge of English, both written and spoken, is required
The resource SHOULD have the following skills and experience:
• Experience in building SIEM architectures from initial design to implementation, including designing data ingestion pipelines for diverse log sources across cloud and on-prem environments
• Proven knowledge of monitoring AWS environment (Iaas, Saas, Paas)
• Knowledge of at least one general-purpose or shell scripting language (e.g. Ruby, Bash, PowerShell, Python, etc.)
Required Soft Skills:
• Excellent communication skills
• Customer-facing experience and oral communication skills
• Ability to write documentation & reports
• Creativity/ ability to find innovative solutions
• Willingness to learn on the job
• Conflict management & cooperation
Desirable certifications:
• Technical certifications: MCSE, CCNA, Microsoft Azure (e.g., SC-200), GCIH, CEH, GCFA or any GIAC/similar certification
• Relevant industry certifications
For Immediate Response, Please send your Resume to Global-Recruitment@Trigyn.com
TRIGYN TECHNOLOGIES is a multinational IT services company with resources deployed in 28 countries. TRIGYN is an ISO 9001:2015, ISO 27001:2022 (ISMS) and CMMI Level 5 certified company. TRIGYN has offices in the United States, Canada, Switzerland and India.