Cloud SOC Incident Analyst

Talent Web Recruitment; Sydney; On-site; AUD 90,000 - 120,000; Full time

Benefits offered by this job

4-day work week

12-month contract

Sydney CBD location

Job summary

Talent Web Recruitment is seeking a Cloud SOC Incident Analyst for an international financial services organisation in Sydney. The role focuses on identifying, analysing, mitigating and responding to security threats across Azure, AWS, GCP and SaaS apps.

You will work with a global team and use Splunk, Log Analytics, and Elasticsearch to view logs. The position offers a 12-month contract and a 4-day work week from Sydney CBD.

Qualifications

• Experience in responding to cyber security incidents within at least one cloud environment (Azure, AWS or GCP).
• Ability to work unsupervised on incidents from triage to closure.
• Ability to identify, interpret and present logging data from a SIEM (Splunk or Elasticsearch).
• Broad awareness of information security operations and/or enterprise IT.

Responsibilities

• Investigate and respond to incidents and alerts across Azure, AWS, GCP and SaaS apps.
• Tune and improve existing detections and develop new ones.
• Analyze unfamiliar data during incidents and assess relevance.
• Communicate clearly with technical and non-technical audiences.

Skills

Cloud security

Incident response

SIEM analysis

Unsupervised work

Tools

Splunk

Elasticsearch

Log Analytics

Azure

AWS

GCP

Job description

An international financial services organisation isseeking a skilled and motivated Cloud SOC Incident Analyst with between 2 and 5 years of experience within a Cloud Security Operations Centre environment.

You willfocus on identifying, analysing, mitigating and responding to security threats and alerts across Azure, AWS, GCP and SaaS applications.

What you will do:

• Use your cloud security knowledge, skills and investigative mindset to investigate and respond to incidents and alerts. This could include anything from brute-force attempts, suspicious AI utilisation, data exfiltration and exploitation of CVEs, to anything in between.
• Identify unfamiliar data in the midst of an incident and assess its relevance.
• Use Splunk and Log Analytics to view logs related to Azure, AWS, GCP and SaaS applications.
• Improve our existing alerting, including tuning existing detections and developing new detections.
• Communicate clearly, concisely and inclusively, both in writing and verbally, with technical and non-technical audiences, including colleagues, peers and stakeholders.
• Work alongside a global team, with colleagues in the USA, Europe and the Asia-Pacific region, placing emphasis on collaboration and the sharing of ideas and methodologies.

• 12-month contract
• Sydney CBD location
• 4-day work week

Your role

An international financial services organisation isseeking a skilled and motivated Cloud SOC Incident Analyst with between 2 and 5 years of experience within a Cloud Security Operations Centre environment.

You willfocus on identifying, analysing, mitigating and responding to security threats and alerts across Azure, AWS, GCP and SaaS applications.

What you will do:

• Use your cloud security knowledge, skills and investigative mindset to investigate and respond to incidents and alerts. This could include anything from brute-force attempts, suspicious AI utilisation, data exfiltration and exploitation of CVEs, to anything in between.
• Identify unfamiliar data in the midst of an incident and assess its relevance.
• Use Splunk and Log Analytics to view logs related to Azure, AWS, GCP and SaaS applications.
• Improve our existing alerting, including tuning existing detections and developing new detections.
• Communicate clearly, concisely and inclusively, both in writing and verbally, with technical and non-technical audiences, including colleagues, peers and stakeholders.
• Work alongside a global team, with colleagues in the USA, Europe and the Asia-Pacific region, placing emphasis on collaboration and the sharing of ideas and methodologies.

Your Experience:

• Experience in responding to cyber security incidents within at least one of Azure, AWS or GCP cloud environments
• An investigative and inquisitive approach to incidents, and the ability to work unsupervised on incidents from initial triage through to closure
• Ability to identify, analyse, interpret and present logging data from a SIEM, such as Splunk or Elasticsearch
• Broad awareness of information security operations and/or enterprise information technology

The working hours are 9:00AM to 7:30PM AEST, 4 days (38 hours) per week on one of two shifts, Wednesday to Saturday or Sunday to Wednesday, to align with the nature of the support provided by the team.

Additional information

• 12-month contract
• Sydney CBD location
• 4-day work week