Security Expert

Persist security is seeking a highly skilled and motivated Security Expert for leading SOC operations with a strong background in Security Operations Center (SOC) environments. The ideal candidate will have extensive experience with Wazuh SEIM , Iris DiFR, Co-pilot by SocFortunes , forensic tools, firewalls, Office 365, Python scripting, and Security Orchestration, Automation, and Response (SOAR) systems. This role involves developing SOC orchestration automation monitoring, analyzing, and responding to security incidents, performing forensic investigations, and implementing security measures to protect our organization's information assets.

Key Responsibilities:

Developing SOC and system methodology and playbooks

Security Monitoring and Incident Response

 - Monitor security alerts from various sources, including Wazuh and other SIEM systems.

 - Analyze and triage security incidents to determine their impact and scope.

 - Respond to security incidents, including containment, eradication, and recovery efforts.

 - Maintain incident response documentation and post-incident analysis.

- *Forensic Investigations:

 - Conduct digital forensic investigations using tools such as Iris DiFR.

 - Collect, analyze, and preserve digital evidence in support of incident investigations.

 - Prepare detailed forensic reports and present findings to relevant stakeholders.

- Security Operations:

 - Implement and maintain security controls, including firewalls and endpoint protection systems.

 - Conduct regular security assessments and vulnerability scans.

 - Collaborate with IT teams to ensure security best practices are followed.

 - Participate in the development and enhancement of SOC processes and procedures.

- Threat Intelligence and Analysis:

 - Research and stay updated on emerging security threats and vulnerabilities.

 - Analyze threat intelligence and provide recommendations for proactive security measures.

 - Develop and maintain threat detection rules and use cases.

- Security Automation and Scripting:

 - Develop and maintain security automation scripts using Python.

 - Create custom Python scripts to enhance incident detection and response capabilities.

 - Automate repetitive security tasks to improve efficiency and accuracy.

- SOAR Integration and Management:

 - Implement and manage Security Orchestration, Automation, and Response (SOAR) systems.

 - Develop and maintain SOAR playbooks to streamline and automate incident response processes.

 - Integrate SOAR systems with existing security tools and infrastructure.

Qualifications:

Proven experience working in a SOC and SOAR system environment - must

- Expertise with Wazuh SEIM, Iris DiFR, and other forensic tools.

- Strong understanding of firewall and network topology configurations and management.

- Experience with Office 365 security and compliance features.

- Proficiency in Python scripting for security automation.

- Hands-on experience with SOAR systems.

- Excellent analytical and problem-solving skills.

- Strong communication and interpersonal skills.

- Linux expires -must

- AWS knowledge are a plus.