01Overview
Job Description:
-
Security Monitoring & Alert Triage:
-
Continuously monitor security alerts generated by various security tools (SIEM, EDR, IDS/IPS, firewalls, etc.) for suspicious activities, anomalies, and potential security breaches.
-
Perform initial triage and analysis of security events, correlating data from multiple sources to determine the severity and legitimacy of alerts.
-
Prioritize alerts based on risk and impact, escalating critical incidents to higher-tier analysts or incident response teams as necessary.
-
Incident Detection & Response:
-
Investigate detected security incidents, including malware infections, phishing attempts, unauthorized access, and data exfiltration, to understand their scope, root cause, and impact.
-
Execute incident response procedures to contain, eradicate, and recover from security incidents effectively, minimizing downtime and data loss.
-
Document all incident details, analysis, actions taken, and lessons learned for future reference and compliance.
-
Threat Analysis & Intelligence:
-
Stay up-to-date with the latest cybersecurity threats, vulnerabilities, attack techniques (TTPs), and threat intelligence.
-
Analyze threat intelligence to identify potential risks to the organization and proactively develop detection rules and countermeasures.
-
Contribute to threat hunting activities to proactively identify stealthy threats that may evade existing security controls.
-
Security Tool Management & Optimization:
-
Operate and maintain various security tools and technologies, ensuring their optimal configuration and performance.
-
Assist in tuning security tools to reduce false positives and improve the accuracy of threat detection.
-
Collaborate with security engineers to deploy and integrate recent security solutions.
-
Vulnerability Management & Compliance (especially for Tier 2/Senior):
-
Assist in vulnerability assessments and penetration testing activities to identify weaknesses in systems and applications .
