SOC Analyst

Relevant 10-12  years of experience working within the Security Operations Centre, with emphasis on security platform implementation & administration.
•    Bachelors (Graduation) or higher in Computer Science or equivalent.
•    Experience with LogRhythm and/or other platforms SIEM systems like SPLUNK, ArcSight.
•    Experience with IBM Resilient (preferred) or equivalent SOAR technology like Demisto, Splunk, Service Now.

Technical Experience & Skills Required:
•    Excellent understanding and proven hands-on experience in SIEM concepts such as correlation, aggregation, normalization, and parsing.
•    Experience with deploying and managing a large SIEM deployment.
•    Excellent understanding of enterprise logging standards, with a focus on application logging
•    Advanced knowledge of content creation concepts and best practices
•    Excellent understanding of regular expressions, development of custom/flex Parsers
•    Strong knowledge of frameworks such as Cyber Kill Chain,Mitre  and Adversary Tactics, Techniques and Procedures.
•    Experience in Implementation and support of major SOAR platform (preferred – IBM Resilient) and developing playbooks for automation.
•    Expertise in writing searches, SIEM Infrastructure and content use case development, well-versed with SIEM architecture and design
•    Experience in SIEM & Resilient Administration and analytics development on Information Security, Triage events, Incident Analysis.
•    Hands on exp with information security tools such as SIEMs, FW, IDS/IPS, EDR, Sandboxes, Vulnerability Management, etc.
•    Excellent Python and Unix Shell scripting skills
•    Understanding of events, related fields in log records and alerts reported by various data sources such as Windows/Unix systems, IDS/IPS, AV, HIDS/HIPS, WAFs, firewalls, and web proxies.

•  Excellent understanding of Cyber Security Operations, Incident Response processes.
•    Experience in using scripting languages to automate tasks and manipulate data. Programming experience is a plus.
•    Experience working in a large enterprise environment and integrating solutions in a multi-vendor environment.

Preferred product specialization certifications on QRadar or LogRhythm (SIEM), Resilient (SOAR), CrowdStrike (EDR), Mimecast (Email Security)

Job

AVP

Primary Location

India-Navi Mumbai

Education Level

Bachelor's / Graduation / Equivalent