Cyber Security Analyst

View full description

Requirements:

• Working knowledge of the TCP/IP suite of protocols
• Use Elastic SIEM to monitor security events and logs across the network, endpoints, and cloud environments
• Identify and analyze security threats, vulnerabilities, and anomalies in real-time
• Investigate security incidents, including malware infections, phishing attacks, and unauthorized access attempts
• Perform initial triage and classification of security incidents
• Perform log analysis and correlate security events from multiple sources (e.g., firewalls, IDS/IPS, web servers) to identify potential threats or breaches
• Create and tune detection rules and alerts in Elastic SIEM to improve accuracy and reduce false positives
• Integrate external threat data (e.g., Indicators of Compromise - IOCs, TTPs) into Elastic SIEM

Responsibilities:

• Use Elastic SIEM to monitor security events and logs across the network, endpoints, and cloud environments.
• Identify and analyze security threats, vulnerabilities, and anomalies in real-time, including possible malicious activity, intrusions, and policy violations.
• Investigate security incidents, including malware infections, phishing attacks, and unauthorized access attempts.
• Perform initial triage and classification of security incidents.
• Support the incident response process by gathering relevant data, escalating threats when necessary, and assisting in the remediation and containment of incidents.
• Maintain a detailed incident report with findings, actions taken, and recommendations for future prevention.
• Perform log analysis and correlate security events from multiple sources (e.g., firewalls, IDS/IPS, web servers) to identify potential threats or breaches.
• Create and tune detection rules and alerts in Elastic SIEM to improve accuracy and reduce false positives.
• Collaborate with threat intelligence teams to integrate external threat data (e.g., Indicators of Compromise - IOCs, TTPs) into Elastic SIEM for enhanced detection capabilities.
• Document incidents, findings, and lessons learned to improve future detection capabilities and response protocols.
• Assist in producing periodic security reports and metrics to communicate the effectiveness of threat detection efforts to management.
• Work closely with other teams (e.g., IT, Security Operations, SOC) to ensure a coordinated approach to threat detection and response.
• Contribute to security awareness by sharing insights and recommendations for improving overall security posture.