Security Specialist

Logicalis; Johannesburg; On-site; ZAR 500 000 - 800 000; Full time

Job summary

A leading IT solutions provider in Gauteng, Johannesburg, is seeking a Security Specialist to be part of their Security Operations Centre. The successful candidate will ensure defense against cyber security threats while actively isolating and mitigating security risks. This role involves incident analysis, threat intelligence research, and advanced triage handling. Candidates should have strong knowledge of network security and forensics, as well as a proactive approach to incident management. Join a diverse team in a supportive environment with opportunities for personal growth.

Qualifications

• In-depth knowledge of network, endpoint, threat intelligence, and forensics.
• Ability to act as an incident hunter and not wait for escalated incidents.
• Experience in threat detection analytics development and implementation.

Responsibilities

• Identify, analyze, and react to cybersecurity threats.
• Provide guidance to Tier 1 and 2 SOC Analysts.
• Conduct advanced triage based on defined run books of alerts.

Skills

Network security knowledge

Forensics analysis

Malware reverse analysis

Threat intelligence

Incident response

Job description

Job Description Why choose Logicalis?

It's not just IT solutions, It's IT global know-how!

Logicalis is an international multi-skilled solution provider providing digital enablement services to help customers harness digital technology and innovative services to deliver powerful business outcomes. Our customers span industries and geographical regions; and our focus is to engage in the dynamics of our customers' vertical markets including financial services, TMT (telecommunications, media and technology), education, healthcare, retail, government, manufacturing and professional services, and apply the skills of our 4, employees in modernising key digital pillars; data centre and cloud services, security and network infrastructure, workspace communications and collaboration, data and information strategies, and IT operation modernisation.

We are the advocates for our customers for some of the world's leading technology companies including Cisco, HPE, IBM, CA Technologies, NetApp, Microsoft, Oracle, VMware and ServiceNow. Logicalis employees are innovative, smart, entrepreneurial and customer centric, with a shared ambition of making Logicalis the worlds leading IT Solutions provider!

We offer speedy decision-making, opportunities for personal development, and a supportive, inclusive environment that celebrates our diversity.

Join us and become a part of something epic!

ROLE PURPOSE

The Security Operations Centre will provide defence against security breaches and actively isolate and mitigate security risks. The Security Specialist forms part of the security operations centre SOC team. The SOC Team will identify, analyse, and react to cyber security threats using a reliable set of processes and security technologies. The SOC Team includes the SOC Manager, SIEM Platform Manager, Case Manager, SOC Tier 1,2 and 3 Analysts and Security Specialists. They work with IT operational teams to address security incidents and events quickly. The SOC Team will provide a critical layer of analysis needed to seek out any irregular activity that could suggest a security incident.

ROLE AND DELIVERY RESPONSIBILITIES

• Possesses in-depth knowledge of network, endpoint, threat intelligence, forensics and malware reverse Analysis, as well as the functioning of specific applications or underlying IT infrastructure.
• Acts as an incident "hunter," not waiting for escalated incidents.
• Closely involved in developing, tuning, and implementing threat detection analytics.
• Acts as the escalation for Tier 1 and 2 SOC Analysts.
• Responds to and oversees the remediation of a declared security incident.
• Completes the Root Cause Analysis Report for P1 to P4.
• Provides guidance to Tier 1 and 2 SOC Analysts.
• Uses threat intelligence such as updated rules and Indicators of Compromise (IOCs) to pinpoint affected systems and the extent of the attack.
• Monitors shift-related metrics ensuring applicable reporting is gathered and disseminated to the SOC Manager.
• Make recommendations to the SOC Manager.
• Oversees the analysis on running processes and configs on affected systems.
• Undertakes in-depth threat intelligence analysis to find the perpetrator, the type of attack, and the data or systems impacted.
• Oversees the containment and recovery.
• Oversees the deep-dive incident analysis by correlating data from various sources.
• Validates if a critical system or data set has been impacted.
• Provides support for analytic methods for detecting threats.
• Conducts advanced triage based on defined run books of alerts.
• Undertakes threat intelligence research if need be.
• Validates false positives, policy violations, intrusion attempts, security threats and potential compromises.
• Undertakes security incident triage to provide necessary context prior to escalating to relevant Security Specialists to perform deeper analysis when necessary.
• Further analyses alarms by method e.g. credentials compromised and by asset class.
• Based on the correlation rules and alarms within the SIEM and run books, further analyses anomaly tactic using the MITRE ATT.