Security operations center analyst

findev; United States; Hybride; USD 75 000 - 110 000; Plein temps

Avantages offerts par ce poste

Remote or hybrid work model

Health insurance 50% coverage

24 days of paid vacation

10 days paid sick leave

50% reimbursement for professional培训

Résumé du poste

Компания findev ищет аналитика центра мониторинга безопасности (SOC) для обеспечения фронтальной поддержки глобальной инфраструктуры. Ваша задача — мониторинг, расследование и реагирование на инциденты в реальном времени, настройка Playbooks и поддержка процессов реконвенций.

Требуется 1–3 года опыта в SOC, знание SIEM, Microsoft 365, Entra ID и Active Directory, а также базовые навыки PowerShell/Python. Гибридная работа, удалённая возможность и поддержка профессионального обучения.

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, IT, Engineering, or equivalent practical experience.
• 1–3 years experience in SOC, incident response, or Tier 2+ technical support.
• Experience with security monitoring, log analysis, alert triage, or SIEM.

Responsabilités

• Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.
• Correlate logs and evidence across tools to determine scope, severity, impact.
• Investigate routine events and elevate significant activity with clear findings.
• Maintain accurate case notes, timelines, evidence, and incident records.
• Execute playbooks and support containment, remediation, recovery, post-incident review.

Connaissances

Security monitoring

Log analysis

Incident response

Microsoft 365

Entra ID

Active Directory

Networking basics

PowerShell

Python

Troubleshooting

Formation

Bachelor's degree in Cybersecurity or related field

Outils

Microsoft Sentinel

Microsoft Defender XDR

CrowdStrike

Splunk

Proofpoint

SailPoint

Palo Alto Networks

Rapid7

ServiceNow Security Operations

Description du poste

Описание:

A company Cybersecurity organization is seeking a Security Operations Center (SOC) Analyst to provide front-line monitoring, investigation, and response across the firm's global environment. The role is intended for a technical professional with foundational cybersecurity knowledge and practical experience in security operations, IT operations, infrastructure support, networking, systems administration, or a related discipline.

Задачи:

• Monitor and triage endpoint, identity, cloud, network, email, and application security alerts.
• Correlate logs and evidence across multiple tools to determine scope, severity, and likely impact.
• Independently investigate routine events and elevate significant or ambiguous activity with clear findings.
• Maintain accurate case notes, timelines, evidence, and incident records.
• Execute approved playbooks and support containment, remediation, recovery, and post-incident review activities.
• Investigate phishing, credential misuse, malware, account takeover, privileged-access, and insider-risk scenarios.
• Identify affected users, systems, identities, applications, and data sources.
• Analyze suspicious authentication, Microsoft Entra ID, Active Directory, multi-factor authentication, and privileged-access activity.
• Investigate user-reported phishing and coordinate remediation and follow-up.
• Analyze endpoint detections and response alerts and security events across Microsoft 365, cloud, and SaaS platforms.
• Use approved AI-assisted tools to help investigate, summarize evidence, and improve analyst efficiency.
• Create or modify basic PowerShell, Python, or similar scripts to reduce repetitive work.
• Improve runbooks, knowledge articles, detections, and processes by identifying false positives and coverage gaps.

Требования:

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, or a related field, or equivalent practical experience.
• One to three years of relevant experience in a SOC, incident response, information security, NOC, systems administration, infrastructure operations, cloud operations, or Tier 2+ technical support role.
• Experience with security monitoring, log analysis, alert triage, or a Security Information and Event Management (SIEM) platform.
• Working knowledge of Microsoft 365, Microsoft Entra ID, Active Directory, Windows, basic Linux administration, and networking fundamentals including DNS, TCP/IP, VPN, and firewalls.
• Understanding of common attack techniques, including phishing, credential theft, malware, privilege escalation, lateral movement, and account compromise.
• Familiarity with the MITRE ATT&CK framework and basic PowerShell, Python, or comparable scripting.
• Strong troubleshooting, analytical, documentation, organizational, and communication skills; able to remain effective during time-sensitive incidents.
• Будет плюсом: Prior experience as a SOC or NOC analyst, system administrator, infrastructure engineer, Tier 2/3 support professional, or military cyber specialist; Experience in financial services or another regulated industry; Hands‑on exposure to Microsoft Sentinel, Microsoft Defender XDR, CrowdStrike, Splunk, Proofpoint, SailPoint, Palo Alto Networks, Rapid7, or ServiceNow Security Operations; Experience using approved large language model or AI-assisted tools for investigation, analysis, documentation, or automation; CompTIA Security+; Microsoft SC-900: Security, Compliance, and Identity Fundamentals; CompTIA CySA+; (ISC)² SSCP; GIAC GSEC or GCIH

Условия:

• Flexible work setup: remote or a hybrid model.
• Health insurance coverage 50% coverage of health insurance for spouses and children 24 days of paid vacation.
• 10 days of paid sick leave.
• 50% reimbursement for professional training, education, conferences.
• Work alongside a highly professional team.
• Engaging teambuilding events and activities.
• Flight tickets, accommodation rent for 1st month for our relocated employee and his/her official family.
• Visa sponsorship, including support with the visa application process, entry permits, and residence permits.