SOC ANALYST

Job Title: SOC Analyst
Location: Cardiff, None
Department: Security Operations Team
Join us now, the Security Operations Centre Team are growing, we are looking to recruit a candidate with SIEM / SOC experience to join the team and become a Security Analyst.

SKILLS AND QUALIFICATIONS

Security Proficiency (Essential)

• 2 years security experience covering SIEM / SOC experience or equivalent security role within another organisation.
• Experience with Microsoft SENTINEL or comparable SIEM technologies.
• SIEM / SOC experience within another organisation.

Security Proficiency (Desirable)

• SC-200: Microsoft Security Operations Analyst or similar SIEM/ SOC based qualifications
• MS-500: Microsoft 365 Security Administration
• Experience with Graph API and/or Kusto Query Language (KQL)
• Experience with SOAR automation.
• CompTIA CyberSecurity Analyst + or equivalent
• AWS Cloud Practitioner

Core skills and attributes

• Excellent written and verbal communication skills (presentations and documentation).
• Experienced in use of ITIL based IT Servicing.
• Solid understanding of IT and information security principles.

• Responsible for the execution/ adherence to of day-to-day operations / daily checks / processes.
• Act as a subject matter expert specifically for SIEM and related / dependent technologies (log aggregation etc).
• Ensuring that cyber playbooks / runbooks are utilised for the most common / prevalent attacks.
• Act as initial triage and initial investigations of security events within SIEM.
• To report any SIEM gaps in coverage or failure, degradation, or anomalies within the SIEM Platform.
• To work side by side with vendors, professional services and security engineers in maintaining, updating or health checking the SIEM, related technologies and its data sources as well as actively looking for blind spots or gaps in event monitoring coverage.
• To threat hunt and report, within the network for a specific number of hours per week, looking for anomalies, misconfigurations or suspicious network activity utilising the telemetry data available in SIEM.
• To action all support tickets in a timely manner as dictated by SLA’s.
• To perform any task as directed by Head of Information Security or CISO.
  The responsibilities detailed above are not exhaustive and you may be requested to take on additional responsibilities deemed as reasonable by their direct line manager.