senior soc analyst

توضیحات آگهی

The Senior SOC Analyst is responsible for advanced security monitoring incident investigation threat hunting detection engineering incident response and security automation The role requires strong hands on experience in investigating complex cybersecurity incidents identifying attacker behaviors and TTPs developing and tuning security detections and designing automated SOC workflows using SOAR platforms The analyst is expected to continuously improve SOC detection and response capabilities by identifying detection gaps reducing false positives improving investigation processes and automating repetitive security operations Key Responsibilities Perform advanced investigation and analysis containment eradication recovery root cause analysis and post incident review Conduct proactive threat hunting using SIEM EDR XDR network authentication and application telemetry Map security incidents and detection scenarios to the MITRE ATT CK framework Develop implement test and tune SIEM correlation and detection rules Reduce false positives and continuously improve detection accuracy and coverage Develop and maintain SOC playbooks runbooks investigation procedures and incident response procedures Support digital forensic and malware analysis activities when required Coordinate with infrastructure network endpoint application DevOps and security engineering teams during security incidents Analyze incident trends and contribute to SOC metrics reports lessons learned and continuous improvement initiatives Design develop implement and maintain SOAR workflows and automated incident response playbooks Technical Skills Strong hands on experience with SIEM and detection engineering preferably Splunk Enterprise Security including SPL correlation rules data models and Risk Based Alerting RBA Experience with SOAR and security automation including playbook development REST APIs JSON webhooks and security system integrations Strong knowledge of incident response threat hunting advanced log analysis event correlation and MITRE ATT CK TTP analysis Strong understanding of Windows Linux Active Directory identity security and network protocols including TCP IP DNS HTTP HTTPS TLS VPN firewalls and proxies Knowledge of web application attacks and OWASP techniques as well as malware behavior persistence privilege escalation credential access lateral movement defense evasion and command and control techniques Experience with digital forensics malware analysis IOC investigation and Threat Intelligence platforms such as MISP Experience with network security analysis tools such as Zeek Suricata Snort and Wireshark Experience Qualifications 5 years of cybersecurity experience with strong hands on experience in SOC operations incident response threat hunting detection engineering or security automation Demonstrated experience investigating complex cybersecurity incidents Practical experience developing and tuning SIEM detection and correlation rules Practical experience designing or implementing SOAR workflows and security automation Strong understanding of enterprise network endpoint identity application and security architectures Ability to independently investigate incidents from initial detection through containment root cause analysis and lessons learned Ability to translate attacker behaviors and investigation findings into new detections hunting scenarios and automation workflows Strong technical documentation analytical problem solving and communication skills Bachelor s degree in Cybersecurity Computer Science Information Technology or a related field is preferred equivalent practical experience is also acceptable تهران تهران سعادت آباد تمام وقت توسعه فناوری گروه فارابی کارشناس ارشد جنسیت تفاوتی ندارد فناوری اطلاعات نرم افزار و سخت افزار