Salary:Up to £65,000 + Shift Allowance Bonus + Additional Corporate Benefits Package!
The Client:A leading technology MSSP requires a security operations analyst (L3).
Job Description:
As an experienced Senior Cyber Security Operations Analyst, you will be responsible for handling security incidents received/escalated from the CSOC Analyst (Tier 1 or Tier 2) and perform a business impact analysis on the security incident.
You will leverage a deep understanding of information security technologies, aid in triaging threat intelligence from multiple sources, and add contextual information to the security incident. Perform additional analysis, and based on the business impact, recommend the response actions and escalation path.
You will be guided by Threat Intelligence which is actionable information (IOCs/TTPs), conduct threat hunting activities; leveraging and analyzing sources of information as available through the SIEM, in addition to identifying and investigating potential suspicious activity as well as helping organizations identify, isolate, and contain security issues.
You will support the initial implementation of new security-related Microsoft technologies, including Microsoft Sentinel, MDE, MDI, and Defender for Cloud.
What You'll Be Doing:
- Oversee completion of day-to-day checklist(s), including log review, management report scheduling & running, alert analysis, and escalation follow-up.
- Remain current on cyber security trends and intelligence (open source and commercial) to guide the security analysis & identification capabilities of the CSOC team.
- Provide oversight, guidance, and mentoring to L2 & L3 analysts, and fulfill SOC Manager responsibilities in the absence of the SOC Manager.
- Manage a number of analysts as part of a virtual team of L1 and L2 analysts, including objectives setting, performance management/reviews, training & development, and BAU activities including shift cover, etc.
- Support on-call arrangements as part of a Rota, to support L1 Analysts working out of hours.
- Support Major Incident Response activity, from a Protective Monitoring perspective, including supporting teams in the identification, containment, and remediation of security-related threats.
- Provide timely advice and guidance on the response action plans for events and incidents based on incident type and severity.
- Identify, create and implement improvements to procedures and processes, with the SOC Manager's approval.
- Identify opportunities for SOC and client SIEM platform configuration improvements, use case development, monitoring rule creation, tuning & optimization.
- Stakeholder and Client Reporting, and engagement.
- Assist in architectural design to facilitate the onboarding of new information systems, including the assessment, parsing, onboarding of log sources, and use case and rule development.
What we're looking for:
- Level 3 SOC Analyst / Senior Cyber Security and security operations experience OR a Level 2 SOC Analyst who has experience assisting in L3 activities at a good level.
- Experience in managing Microsoft Sentinel as an MSSP, including Lighthouse, and management and multi-customer environments using DevOps.
- Experience of onboarding, tuning, reporting, and configuring SIEM solutions.
- Experience of threat intelligence.
- Leadership and mentoring experience and skills.
- Understanding of low-level concepts including operating systems and networking.
- Commercial experience in Penetration Testing and/or Security Monitoring.
- Understanding of networking and infrastructure design.
- Knowledge/experience of one or more System administration (Linux, Windows, Mac).
- Self-motivated individual with a flexible approach to working.
- Excellent interpersonal skills with the ability to explain technical problems to non-technical business stakeholders at all levels.
- Strong written and oral communication skills.
- Active or ability to obtain SC clearance.
Preferred Qualifications & Experience:
- IT Certifications, including Network+, Security+.
- Protective Monitoring / SOC Certifications, including CySA+.
- Cyber Security Certifications, including CISMP, CISSP.
- Experience with various Microsoft Technologies, including Microsoft Defender for Endpoint, Identity and Cloud.
- Experience with SIEM platforms, including IBM QRadar, Microsoft Sentinel, and LogRhythm.
- In-depth experience with Microsoft Sentinel, including use case and rule development, workbook/playbook creation, KQL & Logic Apps / SOAR.
So, if you feel your skills and experience align with the prerequisites for this role, then please get in touch and apply directly.
Carbon60, Lorien & SRG - The Impellam Group STEM Portfolio are acting as an Employment Business in relation to this vacancy.
#J-18808-Ljbffr
