Roles and Responsibilities
- Monitor security events, alerts, and incidents using SIEM tools.
- Identify, investigate, and respond to potential cybersecurity threats.
- Analyze security logs from firewalls, servers, endpoints, and network devices.
- Detect and investigate phishing attacks, malware, ransomware, and suspicious activities.
- Perform vulnerability assessments and coordinate remediation activities.
- Monitor network traffic to identify unauthorized access and potential security breaches.
- Support incident response and root cause analysis.
- Implement and maintain endpoint security and antivirus solutions.
- Assist in security audits, risk assessments, and compliance activities.
- Maintain security documentation, incident reports, and investigation records.
- Collaborate with IT and infrastructure teams to resolve security issues.
- Follow organizational security policies and industry best practices.
Technical Skills Required
- Knowledge of networking concepts such as TCP/IP, DNS, DHCP, HTTP, HTTPS, and VPN.
- Understanding of Windows and Linux operating systems.
- Hands-on knowledge of SIEM tools such as Splunk, IBM QRadar, or Microsoft Sentinel.
- Familiarity with security tools such as Wireshark, Nmap, Nessus, and Qualys.
- Knowledge of firewalls, IDS, IPS, and endpoint security solutions.
- Understanding of vulnerability management, CVE, and CVSS.
- Knowledge of threat detection, log analysis, and incident response.
- Basic understanding of cloud security (AWS / Azure).
Required Skills
- Strong analytical and problem-solving abilities.
- Good communication and interpersonal skills.
- Attention to detail and critical thinking.
- Ability to investigate and resolve security incidents.
- Ability to work independently and collaboratively.
- Willingness to learn emerging cybersecurity technologies.
Key Performance Indicators (KPIs)
- Timely identification and escalation of security incidents.
- Effective monitoring and investigation of security alerts.
- Timely reporting and remediation of vulnerabilities.
- Compliance with organizational security policies.
- Accuracy of incident documentation and security reports.
