Middle SOC Analyst

at  Quadcode

ABOUT TEAM

We are Quadcode, a fintech company excelling in financial brokerage activities and delivering advanced financial products to our global clientele. Our flagship product, an internal trading platform, is offered as a Software-as-a-Service (SaaS) solution to other brokers.
Now we are looking for a Middle SOC Analyst for the Security Operations Center Team.
The team works with various Infrastructure teams (Admins, NOC, OPS, Compliance) to identify and mitigate security issues, vulnerabilities, and misconfigurations by applying their in-depth security knowledge of operating systems, infrastructure, cloud providers, etc. Also, they work very closely with the Security Operation Center and help them with the incident response process.
Now the team has 2 SOC Analysts, 3 SOC Engineers, and a Team Leader.
Working with Agile, Scrum (1–2-week sprints, grooming, planning, retrospective), and SAFe framework. Furthermore, we are using Google meet, Slack, TargetProcess, Wiki, Confluence for teamwork. Daily scrum standups conduct at 12:45 UTC+2 (Cyprus time zone), engaging in peer code reviews.
As the other members of the team, you will be responsible for events monitoring and incidence management process improvement.
We are ready to take you opportunity to work with modern technological stack in IT industry and grow up inside the Company. For example, working with cloud and hybrid infrastructure using tools and techniques at the cutting edge.

REQUIREMENTS

• Specialized experience in SOC as an analyst for at least 2 years;
• Automation skills (Python);
• Experience in investigating incidents as an L2 analyst, including those affecting remote employees;
• Experience in collecting and processing indicators of compromise from various systems;
• Experience in writing correlation rules;
• Experience in testing correlation searches via attack emulation;
• Knowledge of security mechanisms of modern operating systems;
• Knowledge of how network attacks, attacks on infrastructure, attacks on web applications occur;
• Experience in operating SIEM systems(Splunk as a plus);
• Knowledge of the threats of modern IT technologies;
• Knowledge and experience with Mitre ATT&CK.

• Events correlation rules development;
• Incidents response playbooks development and their automation;
• Security events analysis and monitoring;
• Partaking and/or leading the incident response processes;
• Search, analysis and coordination of vulnerabilities elimination;
• Detection rules operational checks via attacks emulation;
• Security tools research and development;
• Conducting periodic exercises to respond to security incidents;
• Connection of the new log sources and processes to SIEM and SOC tools;
• Define requirements for the secure configuration of the operating systems, networks and services in terms of processing of the information security incidents.