SOC Analyst: Alert Tuning, IR & MITRE Coverage

3M HEALTHCARE; San Francisco (CA); On-site; USD 115,000 - 145,000; Full time

Benefits offered by this job

Health insurance

401k match

Parental leave

Paid vacation

Commuter pass

Free meals

Equipment provided

Job summary

BitGo is seeking a versatile SOC analyst to join the team and write, tune and respond to alerts across endpoints to cloud infrastructure. The role supports 24x7 coverage with occasional evenings and weekends. From time to time, evenings as well, with a future goal of 24x7 coverage.

Regular business hours are the baseline for this role. You will review alerts, tune rules to reduce false positives, write MITRE ATT&CK coverage rules, escalate incidents, and assist in incident response.

Qualifications

• 2+ years responding to alerts.
• Familiar with MITRE ATT&CK framework.
• Comfortable writing and tuning detection rules.
• Experience triaging alerts and establishing if an event rises to an incident.
• Varied exposure to a variety of application, SaaS, cloud and end point logs.
• Strong communication skills towards technical and non-technical people.
• Preference for those who have experienced a real-life security incident that they detected.

Responsibilities

• Review and triage security alerts from a wide variety of sources across the organization.
• Carefully tune rules to reduce false positives.
• Write new rules to ensure appropriate MITRE ATT&CK framework coverage.
• Escalate potential incidents.
• Assist in any incident response activities.
• Ability to run projects from beginning to end.
• Work with Engineering and IT on visibility coverage and detection.

Skills

MITRE ATT&CK

Alert tuning

Incident response

Log analysis

Communication skills

Job description

BitGo is seeking a versatile SOC analyst to join the team and write, tune and respond to alerts across endpoints to cloud infrastructure. The role supports 24x7 coverage with occasional evenings and weekends. From time to time, evenings as well, with a future goal of 24x7 coverage.

Regular business hours are the baseline for this role. You will review alerts, tune rules to reduce false positives, write MITRE ATT&CK coverage rules, escalate incidents, and assist in incident response.