Key Responsibilities
- Monitor security alerts, logs, and events using SIEM tools.
- Identify, investigate, and respond to potential security incidents.
- Perform threat analysis, vulnerability assessments, and risk analysis.
- Monitor network traffic and endpoint security alerts.
- Analyze phishing emails, malware alerts, and suspicious activities.
- Support incident response, containment, eradication, and recovery.
- Conduct vulnerability scanning and coordinate remediation activities.
- Maintain security documentation, incident reports, and investigation records.
- Support compliance with security policies and standards such as ISO 27001, NIST, and CIS Controls.
- Collaborate with IT, network, and infrastructure teams to improve security.
Required Technical Skills
- Knowledge of cybersecurity principles and common attack techniques.
- Understanding of TCP/IP, DNS, HTTP/HTTPS, firewalls, VPNs, and networking.
- Experience with SIEM tools such as Splunk, Microsoft Sentinel, or IBM QRadar.
- Familiarity with endpoint security and EDR tools such as Microsoft Defender or CrowdStrike.
- Knowledge of Windows and Linux operating systems.
- Understanding of incident response, vulnerability management, and threat intelligence.
- Basic knowledge of scripting using Python or PowerShell is an advantage.
Preferred Skills
- Analytical and problem-solving abilities.
- Strong communication and documentation skills.
- Ability to investigate security incidents and prioritize risks.
- Willingness to learn new security tools, threats, and technologies.
