Roles and Responsibilities
- Monitor security alerts and events through SIEM platforms.
- Analyze and investigate potential security incidents.
- Identify suspicious activities, malware, phishing attempts, and unauthorized access.
- Perform initial incident triage and escalate critical security threats.
- Monitor network traffic, system logs, and endpoint security alerts.
- Investigate security incidents and document findings.
- Work with cybersecurity teams to support incident response activities.
- Analyze security logs and identify potential vulnerabilities.
- Follow established security procedures and incident management processes.
- Prepare security reports and maintain incident documentation.
- Support vulnerability management and security monitoring activities.
- Stay updated on emerging cybersecurity threats and attack techniques.
Required Technical Skills
- Basic to strong understanding of cybersecurity concepts.
- Knowledge of SIEM tools such as Splunk, Microsoft Sentinel, or IBM QRadar.
- Understanding of networking concepts (TCP/IP, DNS, HTTP, HTTPS).
- Knowledge of Windows and Linux operating systems.
- Understanding of firewalls, IDS, and IPS.
- Knowledge of security incident detection and response.
- Familiarity with log analysis and threat monitoring.
- Understanding of phishing, malware, ransomware, and other cyber threats.
- Knowledge of vulnerability management fundamentals.
- Basic understanding of MITRE ATT&CK framework.
Preferred Skills
- Experience with Splunk Enterprise Security.
- Knowledge of Microsoft Sentinel and Defender.
- Familiarity with CrowdStrike or other EDR solutions.
- Knowledge of Wireshark.
- Understanding of threat intelligence platforms.
- Familiarity with vulnerability assessment tools.
- Knowledge of Python or PowerShell scripting.
- Relevant cybersecurity certifications such as:
- CompTIA Security+
- CompTIA CySA+
- Microsoft Security certifications
- Certified SOC Analyst (CSA)
Required Soft Skills
- Strong analytical and problem-solving skills.
- Attention to detail.
- Good communication and documentation skills.
- Ability to work under pressure.
- Strong teamwork and collaboration.
- Willingness to learn emerging cybersecurity technologies.
