FortiSOAR Specialist

Help Information Technology Consultancy - Sole Proprietorship L.l.c; Dubai; On-site; AED 320,000 - 520,000; Full time

Job summary

Help AG is seeking a Resident Consultant (FortiSOAR Specialist) to orchestrate and automate incident response for customer engagements, both on-site and off-site, leveraging FortiSOAR and related IT security technologies. You will act as the technical SME for automation, integration and playbook development.

You will design, develop and architect FortiSOAR solutions in customer environments, deploy multi-tenant FortiSOAR, and create dashboards, alerts and playbooks to improve detection,

Qualifications

• Degree in computer science, information systems, electrical engineering or related field.
• Minimum 5+ years of FortiSOAR experience is required.
• Experience developing FortiSOAR connectors and playbooks.
• Depth in at least three security domains (SOC operations, IR, threat intel, threat hunting).
• Strong scripting and integration skills (Python, GO, Kusto/KQL, PowerShell).

Responsibilities

• Integrate new logging sources and build playbooks to triage and respond to incidents.
• Develop simple and complex playbooks and connectors with various technologies.
• Deploy, configure, and monitor FortiSOAR in SOC environments.
• Define Jinja filters and functions; support transitions of services to operations.
• Set up dashboards, reports, war rooms, and roaster management.
• Provide ongoing collaboration with customers and internal peers to improve security outcomes.

Skills

FortiSOAR

Playbooks development

Python

PowerShell

Go

Kusto/KQL

SIEM integration

System integration

Connector development

Automation

Education

Bachelor's degree in Computer Science / Information Systems / Electrical Engineering

Tools

Splunk

Microsoft Sentinel

QRadar

Securonix

Job description

Resident Consultant (FortiSOAR Specialist)

Job Description

Help AG is looking for a talented and experienced Resident Consultant (FortiSOAR Specialist) who will be responsible for orchestration and automation of incident response. This role directly supports customer engagements, working both off-site and on-site, leveraging FortiSOAR solutions and their own knowledge of IT and security technologies to perform, guide and direct customers in the value and implementation of SOAR. This role is the primary technical and operational SME for Automation, Integration and Playbook development.

Responsibilities

• Integrate new logging sources and build playbooks to properly triage and respond to security incidents while reducing the time needed to analyze each event.
• Develop simple and complex playbooks and simple/custom connectors integrating with various technology.
• Deploy, configure, manage, operate, and monitor FortiSOAR in a SOC environment.
• Identify challenges of customer security teams and assist security teams with SOAR best practices.
• Deploy and manage FortiSOAR VM dedicated, On-prem and cloud (Multitenant).
• Design, develop and architect FortiSOAR in the customer environment.
• Setting up dashboard, reports, incident war room, and roaster management.
• Experience in defining Jinja filters, functions, and conditions.
• Support the service transition process; Work with peers to effectively transition customers and infrastructure into operations.
• Work proactively and collaboratively with peers seeking mutually beneficial outcomes.
• Support rapid and effective detection, mitigation, containment and response to cyber security incidents leveraging integrations with, and capabilities of, infrastructure platforms, tools, assets under management and non-managed customer controls.
• Creation, optimization and documentation of processes, procedures and workflow; Tracking and reporting of SLAs, KPIs and OLAs.
• Initiate, support and manage incidents, problems, issues, risks and compliance activities; 24x7 on call for critical or urgent activities as required.

Qualifications & Skills

• Degree in Computer science, information systems, electrical engineering or a closely related degree.
• Minimum 5+ years of experience in Fortinet FortiSOAR is a must.
• Experience in developing FortiSOAR connectors & playbooks.
• Depth of skills in at least three of the following areas: Security controls operations, cyber incident response, cyber security detection, managed services integration, cyber threat intelligence, threat hunting.
• Exposure to SIEM (Splunk, Sentinel, Qradar, Securonix) systems is strongly preferred.
• Experience in the design, implementation, maintenance and optimization of playbooks for detection, protection, containment and mitigation of cyber security related threats and incidents.
• Strong scripting and integration skills, in languages such as Python, GO, Kusto/KQL, PowerShell.
• Solid experience and understanding of Managed Security Service delivery, cyber security concepts and standards; Demonstrated experience in effectively managing and mitigating security events, threats, attacks and vulnerabilities.
• Working knowledge of cyber threats, threat actors, TTPs and how to mitigate threats in different contexts (on-prem, cloud, distributed).
• Understanding of classic and emerging threat actor tactics, techniques and procedures in both pre and post-exploitation phases of attack lifecycles.
• NSE 6 FortiSOAR Administrator and NSE 7 FortiSOAR Design and Development (Architect) certification is preferred.
• Customer and team-focused attitude.
• Outstanding organizational skills; Ability to lead and motivate skilled security professionals.
• Active listener; Excellent communication, presentation and training skills.
• Ability to interface with, and influence, pre-Sales and sales teams, to achieve agreed business outcomes.
• Strong interpersonal skills with the ability to collaborate well with others and reconcile differences among resources/departments.