Soc Analyst - Bengaluru, Hyderabad, Pune

Job summary

We are currently seeking a Senior Security Associate for our KPMG Managed Services (Spectrum) practice to join us in our Bangalore office.

Responsibilities

• Rapidly identify, categorize, prioritize and investigate events as the initial cyber event detection group for the enterprise using all available security logs and intelligence sources to include but not limited to:
• Continuously monitor SIEM and logging environments for security events and alerts to threats, intrusions, and/or compromises, including:
• Validate alerts as they come in to eliminate false positives and use other internal and external data sources to enrich alerts with additional context
• Perform triage of service requests from customers and internal teams
• Use playbook procedures to carry out standard plays for routine event types and escalate alerts to Level 2 Analysts for further triage and remediation
• Assist with containment of threats and remediation of environment during or after an incident
• Act as a participant during Threat Hunting activities at the direction of one or more Incident Response Handlers
• Document event analysis and write comprehensive reports of incident investigations
• Proactively improve security-related operational processes and procedures
• Use available security tools for historical analysis purposes as necessary for detected events; for example, historical searches using SIEM tools
• Maintain operational shift logs with relevant activity from the Analysts shift. Document investigation results, ensuring relevant details are passed to Level 2 or MDR Analysts for final event analysis
• Update/reference knowledgebase tool as necessary for changes to processes and procedures, and ingest of daily intelligence reports and previous shift logs
• Conduct research and document events of interest within the scope of IT Security
• Alternatively, consulting, or advisory experience in Security Operations
• Monitor and analyse Intrusion Detection Systems (IDS), Anomaly Detection Systems (ADS), Firewall event logs, Security Incident and Event Management (SIEM) toolset and other event logs to identify security attacks and threats for remediation/suppression.
• Validate IOCs that triggered the original alert.
• Research additional internal and external data sources for additional enrichment of event information
• Determine when an event has reached the threshold of an incident and engage Incident Response Handler to declare an incident.
• Create filters, data monitors, dashboards, and reports within monitoring utilities.
• Troubleshoot security monitoring devices to improve event correlation and performance.
• Handle high and critical severity incidents as described in the operations playbook.
• Operational level experience in some of these domains (not all): security engineering, alert triaging, rule writing, incident response, DFIR, threat intelligence and management, vulnerability management, and security control testing
• In-depth knowledge of at least one SIEM platform or security data lake and related processes
• Knowledge of various security tools, their functions, and comparisons
• Knowledge of network and cloud security fundamentals
• Ability to explain complex technical concepts in business terms.
• Extensive experience in report writing and presentation.
• Strong, adaptable, and flexible work ethic
• Good time management skills
• Ability to work under pressure and prioritise activities

Qualifications

• Bachelor's degree in Computer Science, Engineering, Information Technology, Cybersecurity, or related field
• 5+ years of technical experience of prior MDR/SOC/Incident response experience
• Demonstrated technical knowledge of current network security, network hardware, protocols, and standards required
• Shall have demonstrated professional experience in incident detection and response, malware analysis, or cyber forensics
• Act as a workstream participant to support tier-1, tier-2, or tier-3 SOC environments
• Demonstrated strong oral and written communication and client facing skills
• Demonstrated strong analytical and communications skills
• Flexibility to adapt to different types of engagement, working hours, work environments, and locations
• Proven ability to work creatively, analytically in a problem-solving environment
• Ability to work nights, weekends, and/or holidays in the event of an incident response emergency
• Be comfortable working against deadlines in a fast-paced environment
• Identify issues, opportunities for improvement, and communicate them to an appropriate senior member
• Demonstrated technical knowledge of current network security, network hardware, protocols, and standards required

Required skills

• 6+ years of technical experience in Information Security
• Experience with SIEM tools (Qradar, Splunk, Logrhythm, Solarwinds, etc.)
• Experience in Azure Sentinel
• Familiarity with common IDS/IPS and Firewalls (Snort, Cisco, Fortigate, Sourcefire)
• Familiarity with incident response process and activities
• Familiarity with TCP/IP protocol, OSI Seven Layer Model
• Knowledge of Windows, Unix-based systems, architectures, and network security devices
• Intermediate level of knowledge of LAN and WAN technologies
• Must have a solid understanding of information technology, information security domains
• Knowledge of security best practices and concepts
• Desired certifications: Security+, C|EH, Network+, Certified Information Systems Security Professional (CISSP), GIAC Certified Intrusion Analyst, GIAC Certified Incident Handler, or GIAC Reverse Engineering Malware
• Familiarity with ticketing tool / ITSM tool
• Personal drive, positive work ethic to deliver results within tight deadlines and in demanding situations

Preferred candidate profile

Job description