Roles and Responsibilities
- Monitor network traffic, system activities, and security alerts to identify suspicious behavior.
- Analyze security incidents and investigate potential cyber threats.
- Monitor security events using SIEM tools.
- Identify and report security vulnerabilities in systems and applications.
- Perform vulnerability assessments and support remediation activities.
- Monitor firewall, antivirus, and endpoint security alerts.
- Assist in incident detection, investigation, and response.
- Analyze security logs from servers, endpoints, and network devices.
- Support security audits and compliance assessments.
- Implement and maintain information security policies and procedures.
- Monitor unauthorized access attempts and suspicious login activities.
- Assist in threat intelligence analysis and security monitoring.
- Prepare security incident reports and documentation.
- Coordinate with IT and infrastructure teams to resolve security issues.
- Ensure compliance with organizational security standards and best practices.
Technical Skills Required
- TCP/IP, DNS, DHCP, HTTP, and HTTPS.
- LAN, WAN, and VPN concepts.
- IP addressing and subnetting.
- Network protocols and ports.
- Firewall and proxy concepts.
- Windows operating systems.
- Linux fundamentals.
- Windows Event Logs.
- Linux system logs.
- User and permission management.
- Splunk.
- IBM QRadar.
- Microsoft Sentinel.
- Log analysis and monitoring.
- Security event correlation.
- Alert investigation and reporting.
- CIA Triad (Confidentiality, Integrity, Availability).
- Authentication and Authorization.
- Encryption and Decryption.
- Access Control.
- Multi-Factor Authentication (MFA).
- Risk Assessment.
- Security Policies and Procedures.
- Threat and Vulnerability Management:
- Vulnerability identification.
- Risk assessment.
- Security patch management.
- Vulnerability scanning.
- Basic threat intelligence.
- Security configuration review.
- Wireshark.
- Nmap.
- Nessus.
- OpenVAS.
- Microsoft Defender.
- CrowdStrike.
- Incident detection and reporting.
- Security event investigation.
- Incident documentation.
- Basic malware analysis concepts.
- Incident response lifecycle.
Soft Skills
- Strong analytical and problem-solving skills.
- Attention to detail.
- Good verbal and written communication skills.
- Critical thinking and troubleshooting abilities.
- Ability to work under pressure.
- Team collaboration.
- Time management and documentation skills.
- Willingness to learn emerging security technologies.
Key Performance Indicators (KPIs)
- Security incident detection and response time.
- Accuracy of security alert investigation.
- Vulnerability identification and remediation tracking.
- Reduction in security incidents.
- Compliance with security policies.
- Accuracy of security documentation.
- Timely completion of security assessments.
- Effectiveness of security monitoring activities.
Preferred Skills
- Knowledge of cloud security (AWS, Azure, or Google Cloud).
- Understanding of Active Directory.
- Basic knowledge of ethical hacking concepts.
- Familiarity with endpoint detection and response (EDR).
- Knowledge of ISO 27001 security standards.
- Understanding of GDPR and other data protection regulations.
- Basic scripting knowledge using Python, PowerShell, or Bash.
- Familiarity with SOC (Security Operations Center) processes.
Expected Deliverables
- Security monitoring reports.
- Security incident investigation reports.
- Vulnerability assessment reports.
- Security audit documentation.
- SIEM alert analysis reports.
- Risk assessment reports.
- Security compliance documentation.
- Incident response records.
- Security recommendations and remediation tracking.
