Security Operations Center Analyst III (Remote Role)

Sysco; United States; On-site; USD 120,000 - 180,000; Full time

Job summary

Sysco is seeking an experienced cybersecurity professional to join the Vulnerability and Threat Management program. You will analyze alerts, detect threats, and coordinate incident response across Sysco’s network.

The role emphasizes incident handling, use of IDS/IPS/EDR tools, and maintaining incident playbooks to improve defensive posture within the enterprise.

Qualifications

• Minimum 7 years in IT with at least 5 years in incident response.
• Security Certification required.
• Advanced security certifications preferred.

Responsibilities

• Receive, characterize, and analyze endpoint and network alerts from various sources to identify anomalous activity and potential threats.
• Provide timely detection and alerting of possible attacks and distinguish incidents from benign activity.
• Perform event correlation to gain situational awareness and assess observed attacks.

Skills

Incident response

Networking security

IDS/IPS/EDR

Security tools

Incident playbooks

Vulnerability scanning

Threat intelligence

Documentation

Education

Security Certification

Security Certifications

Tools

Tenable.io

Tanium

Job description

This position sits within the Vulnerability and Threat Management program at Sysco where you’ll use defensive measures and information collected from a variety of sources to identify, analyze, and report cybersecurity events that occur or might occur within the Sysco network to protect information, resources, and networks from threats.

Duties and Responsibilities:

• Receive, characterize, and analyze endpoint and network alerts from various sources within the enterprise and determine possible causes of such alerts to identify anomalous activity and potential threats to network resources and users
• Provide timely detection, identification, and alerting of possible attacks/intrusions, anomalous activities, and misuse activities and distinguish these incidents and events from benign activities
• Perform event correlation using information gathered from a variety of sources within the enterprise to gain situational awareness and determine the effectiveness of an observed attack
• Serve as an escalation point to SOC Analysts providing support, guidance, as well as work and track security incidents through final resolution
• Create and maintain incident response processes, procedures and blueprints. Documenting and maintaining knowledge base of incident methodologies and plans

Education Required:

• Security Certification

Education Preferred:

• Security+, CEH, OSCP/OSCE, CISSP, CISA, or GIAC

Experience Required:

• Minimum 7 years in IT 5 years in Incident Response

Experience Preferred:

• 10 years in IT, Minimum 7 years in Incident Response

Licenses/Certification Required:

• Security Certification

Licenses/Certification Required:

• Security+, CEH, OSCP/OSCE, CISSP, CISA, or GIAC

Skills and Abilities:

• 5+ years of cybersecurity incident response experience with excellent background in networking and security to include intrusion detection/prevention
• Excellent knowledge of security applications such as IDS, IPS, EDR, SIEM, next-gen AV and anomaly detection tools
• Knowledge of cyber attack stages (e.g., reconnaissance, scanning, enumeration, gaining access, escalation of privileges, maintaining access, network exploitation, covering tracks.)
• Excellent knowledge of the 6 phases in Cyber incident response plan
• Wide knowledge of application and IT product diversity, interoperability, and extensive knowledge in IT security
• Ability to configure and conduct vulnerability scans using VM tools such as Tenable.io and Tanium

Physical Demands:

• Reasonable accommodations will be made to enable individuals with disabilities to perform the essential functions of this job.