SOC IR Technical leader

A successful, international Corporate is looking for a talented, technical SOC & IR Tier-2 Analyst

to take the lead of a 8 people SOC.

Responsibilities:

• Management of complex cyber incidents using SPLUNK SIEM, EDR and other security platforms.

• Mentoring SOC team and make them expert IR analysts.

• defining needed SIEM monitoring rules per emerging threats.

• defining SOAR automation workflows.

• Creation tabletop cyber simulations and cyber incident training drills.

• Creation Incident Response Playbooks and improve existing ones.

• Leading the SOAR, incident data enrichment and incident response automation capabilities.

• Leading SIEM related projects planning & budget.

• Leading red-team activities.

Candidate Required Former background & Experience:

• Experience working in SOC as a Tier-2 analyst.

• Technical skills relating to SIEM systems with focus on: SPLUNK and SENTINEL

• Windows & Linux environments incident response and investigation.

• Penetration Testing skills and optional certifications – big advantage.

• Good IT experience skills – big advantage.

• Experienced in analysing events in common firewalls, WAF Systems, and EDR systems.

including but not limited to: Fortinet, Checkpoint, F5, Trend Micro, CrowdStrike, SOAR tools.

• Windows and Linux Server internals, windows event ID’s. Active directory etc.

• MITRE framework techniques

• Nessus Vulnerability scanner – familiarity and experience working with such tool.

• Azure security & Sentinel SIEM experience – an advantage

• English – Fluent (MUST) Reading, Writing and talking.

• Hebrew –Capability of conducting lectures and technical training.

*** Managerial experience is not needed.

*** A great Technical IR Knowledge and Capabilities - a must.