Roles and Responsibilities
- Monitor security events and alerts using Security Information and Event Management (SIEM) tools.
- Analyze security logs from firewalls, servers, endpoints, and network devices.
- Identify and investigate suspicious activities, potential threats, and security incidents.
- Perform initial alert triage, classification, and prioritization based on severity.
- Investigate phishing attacks, malware infections, brute-force attempts, and unauthorized access.
- Analyze IP addresses, URLs, domains, and file hashes to identify potentially malicious indicators.
- Monitor endpoint security alerts using Endpoint Detection and Response (EDR) tools.
- Escalate high-priority and critical security incidents to L2/L3 security teams.
- Create, update, and maintain security incident tickets and investigation reports.
- Follow established incident response procedures, security policies, and standard operating procedures.
- Perform basic threat intelligence research and IOC analysis.
- Collaborate with internal IT and security teams to support incident resolution.
- Maintain accurate documentation of security events and investigation findings.
Technical Skills Required
Networking Fundamentals
- TCP/IP, DNS, DHCP, HTTP, HTTPS, and VPN.
- Basic understanding of network ports and protocols.
- Knowledge of firewalls, IDS, and IPS.
Security Fundamentals
- Understanding of malware, ransomware, phishing, and social engineering.
- Knowledge of vulnerabilities, threats, and security risks.
- Understanding of authentication and access control.
- Basic knowledge of incident response processes.
SIEM Tools
- Splunk
- IBM QRadar
- Microsoft Sentinel
Operating Systems
- Windows operating system.
- Linux fundamentals.
- Windows Event Logs and Linux Syslogs.
Security Frameworks
- MITRE ATT&CK Framework.
- Cyber Kill Chain.
- Basic understanding of the CIA Triad.
Tools and Technologies
- SIEM: Splunk, IBM QRadar, Microsoft Sentinel.
- EDR: CrowdStrike Falcon, Microsoft Defender for Endpoint.
- Network Analysis: Wireshark.
- Threat Intelligence: VirusTotal, AbuseIPDB.
- Ticketing Tools: ServiceNow, Jira.
- Security Technologies: Firewall, IDS, IPS, Antivirus.
