Key Responsibilities
- Monitor security alerts, events, and incidents across enterprise IT environments.
- Analyze security logs and investigate suspicious activities, potential threats, and vulnerabilities.
- Perform security incident detection, analysis, response, and documentation.
- Work with SIEM tools to identify and investigate security threats.
- Conduct vulnerability assessments and support remediation activities.
- Monitor network traffic and identify unusual or malicious activities.
- Support endpoint security, firewall, antivirus, and intrusion detection systems.
- Assist in threat intelligence analysis and security risk assessments.
- Perform security audits and ensure compliance with organizational security policies.
- Collaborate with IT infrastructure and network teams to strengthen security controls.
- Prepare security incident reports and maintain investigation documentation.
- Support security awareness initiatives and recommend improvements to security practices.
- Assist in implementing security frameworks and compliance requirements.
Required Technical Skills
Security Monitoring & SIEM
- Splunk Enterprise Security.
- Microsoft Sentinel.
- IBM QRadar.
- Security log analysis and event correlation.
- Security alert monitoring and investigation.
Network Security
- TCP/IP, DNS, HTTP/HTTPS, VPN.
- Firewalls and network access controls.
- IDS/IPS technologies.
- Network traffic analysis.
- Wireshark.
Endpoint & Threat Protection
- Microsoft Defender for Endpoint.
- CrowdStrike Falcon.
- Antivirus and endpoint detection and response (EDR).
- Endpoint security monitoring.
Incident Response & Threat Detection
- Security incident investigation.
- Threat detection and analysis.
- Malware analysis fundamentals.
- Phishing investigation.
- MITRE ATT&CK framework.
- Incident documentation and reporting.
Vulnerability Management
- Nessus.
- Qualys.
- Rapid7.
- Vulnerability scanning and remediation tracking.
- Risk assessment and security controls.
Cloud Security
- Microsoft Azure Security.
- AWS Security fundamentals.
- Identity and Access Management (IAM).
- Multi-Factor Authentication (MFA).
- Cloud security monitoring.
Preferred Qualifications & Certifications
- CompTIA Security+.
- Certified SOC Analyst (CSA).
- Certified Information Systems Security Professional (CISSP), where applicable.
- Certified Ethical Hacker (CEH).
- Microsoft Security certifications.
- GIAC Security Essentials (GSEC).
Key Competencies
- Strong analytical and problem-solving skills.
- Attention to detail.
- Critical thinking and incident investigation capabilities.
- Excellent written and verbal communication.
- Ability to work under pressure during security incidents.
- Team collaboration and stakeholder management.
- Strong understanding of security policies and best practices.
Key Deliverables
- Security monitoring and incident investigation reports.
- Threat detection and security analysis.
- Vulnerability assessment reports.
- Incident response documentation.
- Security risk assessment reports.
- Recommendations for improving organizational security posture.
