Senior Cybersecurity Detection Analyst

Getronics; France; À distance; EUR 55 000 - 75 000; Plein temps

Résumé du poste

Getronics is seeking a Cybersecurity Detection Analyst to join our remote-friendly Security Operations Center. The role focuses on building and maturing MITRE ATT&CK-based detection playbooks and supporting day-to-day threat detection for clients across industries.

Excellent communication and analytical skills are essential for clear documentation and international coordination. You will work on threat detection rules, dashboards, and collaboration with threat intelligence, incident response,

Qualifications

• Minimum two years of experience as Cybersecurity Detection Analyst.
• Experience with hands-on implementation of detection playbooks based on the MITRE ATT&CK framework.

Responsabilités

• Develop threat detection rules to identify modern attacker techniques and tactics in collaboration with threat intelligence, incident response, and security teams.
• Maintain the existing rule base and apply lifecycle management to suppression rules where appropriate.
• Evaluate coverage against the ATT&CK framework to identify gaps and opportunities for improvement.
• Create dashboards to support threat detection use cases and train analysts in their use.
• Provide guidance to threat search activities and develop efficient search queries.
• Develop detection strategies for emerging business needs with IT teams.
• Analyze alert trends to drive improvement.
• Maintain data collection and co-management documentation.

Connaissances

SIEM expertise

Analytical thinking

Threat detection

Communication skills

Formation

Bachelor's/Master's in CS or Security

Outils

QRadar

LogRhythm

Splunk

Elastic Security

InsightsIDR

AlienVault OSSIM

Python

RegEx

Sigma

YARA

Description du poste

At Getronics we are looking to expand our IT Security team by incorporating a Cybersecurity Detection Analyst in remote mode during office hours although if you live in Barcelona or surroundings it would be great as our SOC is located there (not a must).

The person joining will help us build on the existing ATT & CK based managed manual for the Getronics Security Operations Center and develop it to the next level of maturity and capability. In addition, you will support us with the day-to-day threat detection work of a team of analysts serving a wide range of customers in different industries, as well as Getronics' private and hybrid cloud services and internal IT.

Requirements

• Minimum two years of experience as Cybersecurity Detection Analyst and working with SIEM technology (QRadar, LogRhythm, Splunk Elastic Security, InsightsIDR, AlienVault OSSIM, etc.).
• Previous experience in other cybersecurity technical areas, e.g. SOC Analyst, Cyber Intelligence Technical Analyst, pentester, etc.
• Experience with hands-on implementation of detection playbooks based on the MITRE ATT&CK framework.
• Experience as a problem solver and analytical thinker.
• Experience and solid understanding of the information security threat landscape, such as attack vectors and best practices to protect systems and networks.
• Experience and/or advanced knowledge with at least two of the following technologies - Python, RegEx, Sigma and YARA.
• Experience with performance tuning correlation rules.
• Strong communication skills, ability to summarize well and write clear documentation.
• Fluent English, written and spoken as you will have international level interlocutions.
• Structured and results oriented way of working.

One or more of the following would be an asset, although not essential:

• Strong understanding of common logging and analysis formats, including cloud technologies.
• Experience with MITRE D3FEND
• Solid understanding of the cyber threat landscape.
• Desirable certifications/training: SANS SEC511 continuous monitoring (GIAC GMON certification), SIEM certifications (any fabricant), Cloud certifications (AWS, Azure, other).
• Engineering / Master's degree in Computer Science or Security, etc.

Functions

• Develop threat detection rules to identify modern attacker techniques and tactics in close collaboration with threat intelligence, incident response, security analysts, security architects and infrastructure teams.
• Maintain the existing rule base to ensure effectiveness and efficiency and apply lifecycle management to extinguishment rules where appropriate
• Evaluate coverage against the ATT&CK framework to identify gaps and opportunities for improvement
• Develop and maintain effective metrics
• Support on-demand compliance use cases
• Identify need, create and maintain lists as needed to support correlation rules
• Create dashboards to support specific use cases for threat detection and train analysts in their use
• Provide guidance to threat search activities, e.g., by developing efficient search queries
• Develop detection strategies for existing and emerging business needs in collaboration with business and IT teams
• Analyzing alert trends to drive improvement
• Maintaining and improving data collection and co management frameworks and documentation