Trigyn has a contractual opportunity for a Security Operations Analyst. This resource will be working Remotely.
Job Description :
The incumbent will work under the supervision and guidance of the Head of Cyber Security
Operations to provide front-line support to client Partners in the area of information / cyber
security, risk management consulting, and security operations activities in collaboration with a team of information and cybersecurity experts.
The resource will be part of the 24x7 Security Operations Centre (CSOC) and will work in close collaboration with team members distributed around the globe to monitor, detect, triage, investigate and respond to cyber threats targeting its Clients and Partner Organizations.
Scope of Work / Duties of Consultant :
- Monitor and investigate alerts leveraging Microsoft Security Tools (e.g. M365, Cloud App
Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel and XDR)
Monitor and triage AWS security events and detectionsMonitor and investigate alerts leveraging EDR and NDR solutionsReview security events that are populated in a Security Information and Event Management (SIEM) system
Analyze a variety of network and host-based security appliance logs (Firewalls, NIDS, HIDS, Sys Logs, etc.) to determine the correct remediation actions and escalation paths for each incidentIdentify the incident root cause and take proactive mitigation stepsAssist with incident response effortsFollows precise analytical paths to determine the nature and extent of problems being reported by tools, e-mails, alerts, etc.Integrate and share information with other analysts and other teamsDetermine and direct remediation and recovery efforts.Provide other ad hoc support as requiredRequired Technical Skills :
The resource MUST have the following skills and experience :
Knowledge of Transmission Control Protocol / Internet Protocol (TCP / IP) protocolsDeep knowledge of Microsoft Security Tools (e.g. M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR)Deep Knowledge of Cloud technologies (e.g. Azure, AWS and GCP)Deep knowledge of SIEM tools like Splunk, QRadar, ArcSight, MS Sentinel, ELK StackKnowledge of at least one EDR solution (MS Defender for Endpoint, SentinelOne, CrowdStrike)Knowledge of email security, network monitoring, and incident responseKnowledge of Linux / Mac / Windows;A minimum of five (5) years of relevant experience in the information technology field, including triage of alerts and supporting security incidentsProven experience with the usual toolbox available in a SOC (e.g., SIEMs, EDRs), able to autonomously perform technical analysis of security threats and collaborate with the Incident Response teamTrouble ticket generation and processing experienceExtensive Windows, Linux, Database, Application, Web server, etc. log analysisExpert knowledge of English, both written and spoken, is requiredThe resource SHOULD have the following skills and experience :
Experience on an Incident Response team performing Tier I / II initial incident triage.Proven knowledge of monitoring AWS environment (IaaS, Saas, Paas)Knowledge of at least one general-purpose or shell scripting language (e.g. Ruby, Bash, PowerShell, Python, etc.)Required Soft Skills :
Excellent communication skillsCustomer-facing experience and oral communication skillsAbility to write documentation & reports
Creativity / ability to find innovative solutionsWillingness to learn on the jobConflict management & cooperationDesirable certifications :
Technical certifications : MCSE, CCNA, Microsoft Azure (e.g., SC-200), GCIH, CEH, GCFA or any GIAC / similar certificationRelevant industry certifications