Senior SOC Analyst, Ekco

• Have a minimum of 3 years experience working in a SOC environment
• Working knowledge in the following areas:
• Unix, Linux, Windows, etc. operating systems
• MITRE ATT&CK Framework
• Exploits, vulnerabilities, network attacks
• Networking concepts / understanding of networking protocols
• Packet analysis tools (tcpdump, Wireshark, ngrep, etc.)
• Keen problem solving / troubleshooting skills
• Strong analytical skills and a logical approach to resolving issues
• Act as an escalation point to junior members of staff, not limited to tickets
• A can-do attitude
• Excellent written and verbal communication skills. You should be able to communicate technical details clearly at all levels
• The ability to adjust and adapt to changing priorities in a dynamic environment
• A pro-active approach to addressing issues and requests and the ability to multitask
• The ability to learn new technologies and concepts quickly
• Great organisational skills and attention to detail
• Adaptability to do a range of work, including the complex, non-routine, mundane and multi-environment
• Able to work under direction, use discretion and determine when to escalate issues
• Effective communication, teamwork and task-time management skills

Desirable

• Reporting to the regional Head of SOC, the role of the Senior SOC Analyst is to apply the understanding of investigative techniques and analytical skills, to defend against and respond to cybersecurity events and incidents in our client’s IT environments
• You will support clients by ensuring they remain secure, researching new vulnerabilities and assisting with the mitigation of any potential attacks. You will work as part of a team to deliver monitoring and protection in both a reactive and proactive manner. You will also be responsible for rolling out security tools including creating documentation
• SOC Analysts at Ekco are operationally focused; they configure, secure, and monitor systems, using advanced toolsets, to prevent security breaches and to respond to incidents as they arise
• Performing advanced real-time SIEM analysis and correlation of logs/alerts from a multitude of client devices
• Determining if events escalated by the SOC analyst team constitute security incidents, and if they do, you will analyse the incident and escalate with the customer when further investigation or a resolution is needed
• You’ll work with our security engineers to develop and tune SIEM rules
• You will identify and implement parsing configuration as required to optimise log source configuration, aiding investigation efforts
• Analysing and assessing security incidents, performing in depth root cause analyses and advancing to client resources or collaborating with internal teams for additional assistance
• Acting as subject matter expert, investigating security events forwarded from clients
• Act as lead investigator for incident response engagements as required, in the absence of a SOC Principal
• Act as a key contributor to SOC continuous improvement criteria as required, identifying gaps in existing processes, proposing and documenting working solutions to close gaps
• Develop, document, and deliver training material for the SOC Analyst team, providing granular instructions for SOC processes and processes
• Primary responsibility for the creation of custom, ad hoc and monthly reporting solutions for SOC customers as required
• Perform quality control on all types of SOC Reporting
• Providing cover in line with rotating shift patterns. You should be flexible to rotating 8, 10 or 12 hour shifts. We provide 24/7 cover to clients and shifts are allocated accordingly
• Responding to inbound requests via phone and other electronic means for technical assistance
• Performing other duties as assigned by SOC Leadership