Log In
Sign Up
Description:
Duties & Responsibilities:
• Develop automation playbooks using modern SOAR Platforms (for example, FortiSOAR, Phantom) to support Security Operations.
• Design and Develop Integration solutions to other security appliances such as EDR, SIEM, Firewalls, Sandboxing by leveraging SOAR Platform.
• Developing Incident Response Playbooks and Modules and workflows around automation and orchestration.
• Designing SOAR dashboards for Analysts and Management with pertinent KPIs and metrics. • Automate repeatable steps in the Incident Response Activities with the help of tools/scripting languages.
• Extensive experience in Incident Response activities and skilled in Log Analysis. • Test, customize and master APIs for off-the-shelf and common security and IT tools. • Experience in Linux Administration, Patch Management & Change Management process. • Maintain a solid understanding of the Cyber Security Operation Center (people, process, SIEM technology such as ArcSight, Azure Sentinel, etc.)
• A solid understanding of processes involved in prioritization, escalation, and management of security incidents.
• Develop scripts in Python and PowerShell or other alternative scripting languages. • Consult with stakeholder to develop viable use cases for automation and turn those use cases into automated playbooks using Security Orchestration and Automation platforms.
• Strong writing skills and ability to create high value/high impact reusable content. • Understanding the global threat landscape by analyzing cyber threat intelligence.
Requirements:
• Bachelor of Science with a concentration in computer science, information systems, information security and computer engineering disciplines.
• Minimum 4 years latest of hands-on experience with python and SOAR Technologies. • Minimum 4 years prior experience in Network/Information Security domain with roles such as SOC Analyst/Incident Responder etc.
• Preferred trainings & certifications: Any SOAR related certification/training, GCIH, Security+, CEH. • Understanding how modern software architectures works (client-server, Web technology, micro services)
• Strong programming experience solving technical challenges.
• Good knowledge in cloud solutions such as Azure.
• Strong desire to learn new techniques and technology, and the ability to be self-sufficient in problem solving.
• Knowledge or Expertise of the capabilities of common platforms within an enterprise security environment and how they can work together to improve overall security posture (e.g. firewalls, SIEM, Endpoint, Threat Intelligence, Case Management, etc.)
• Working knowledge of operating systems and networking technologies in general • Working knowledge of cyber threats, defenses, motivations, and techniques.
