SOC Security Analyst

TEKsystems is seeking a highly skilled SOC Analyst to join our team. As a SOC Analyst, you will play a critical role in the detection, response, and remediation of cyber-related attacks on the enterprise.

• Assist in the detection, response, and remediation of cyber-related attacks on the enterprise.
• Support incident response and forensics activities, including host triage and retrieval, malware analysis, remote system analysis, and remediation efforts.
• Work with a managed security service provider (MSSP) to onboard new event sources and use cases.
• Utilize technologies such as DLP, DNS, IPS, proxy, SIEM, and related endpoint, mobile, and cloud controls to complete incident response activities and threat hunting.
• Provide thorough results, which are documented and correlated.
• Work with IT and business areas to respond to and perform incident investigations for severity level incidents (high, medium, low).
• Maintain skills and capabilities required to maintain, process, and develop intelligence products that are actionable to internal InfoSec functions, Cyber Security stakeholders, and the business areas.
• Gain understanding and employ multiple analytical frameworks to drive Cybersecurity Maturity model lifecycle against threats that are of interest to the InfoSec organization.
• Provide support in the detection, response, mitigation, and reporting of real or potential cyber threats to the organization and assist in the automation of these processes.
• Perform threat intelligence collection, analysis, and actionable intelligence extraction from the numerous cyber threat intelligence sources that are available externally and internally to the InfoSec organization.
• Assist in developing detection and alert criteria and work directly with Operational Support Team to drive monitoring and defense improvements.
• Assist as needed with forensic analysis of network packet captures, DNS, proxy, malware, host-based security, and application logs, as well as logs from various types of security sensors.
• Perform root cause analysis of security incidents for further enhancement of overall InfoSec defenses.
• Provide metrics to measure the effectiveness of the incident response program at request of Security leadership and SOC lead.
• Participate in incident response operations and development of standard operating procedures, run books, and related templates. Recommend process improvements.
• Participate in all tabletop exercises.
• Update incident response plan and procedures as well as SOC runbooks.
• Provide support, maintenance, and development of the Security Information and Event Monitoring (SIEM) platform. This includes the integration of standard and non-standard logs into SIEM solution while revising and developing processes to strengthen security operations.
• Assist in overseeing and providing feedback for third-party managed security service provider(s).
• Participate in testing to validate effectiveness of security monitoring and alerting.
• Assist with the static and dynamic malware analysis to support InfoSec defenses and understanding of threat actor TTPs.
• Serve as a POC in incident response activities such as host triage and retrieval, malware analysis, remote system analysis, and remediation efforts.
• Create the necessary interpersonal networks among information security and line-of-business staff, compliance, audit, physical security, legal, and HR to ensure alignment.
• Begin to develop and maintain external networks consisting of industry peers, ecosystem partners, vendors, and other relevant parties to address common trends, findings, threats, and cybersecurity risks.
• Act as a technical resource for internal business teams and the IT department to plan, implement, and support new and existing technologies. Serve as an expert in the technical field of knowledge.
• Participate in IT and security-related projects.
• Assist the enterprise architecture and engagement teams to ensure that information security requirements are built into architectures and new technology projects.
• Maintain working knowledge of Payment Card Industry (PCI) Data Security Standard compliance by keeping apprised of changes to the standard, evaluating new systems for impact, and supporting annual PCI audit.
• Support audit and assessment process for IT, including annual PCI audit, IT general controls review, and any other audits or assessments of security and general IT controls.
• Support forensic investigations and data acquisition supporting legal holds.
• Assist in incident identification, assessment, quantification, reporting, communication, and mitigation.
• Monitor for external threats, assessing risk to the environment, and driving proactive risk mitigation and response activities.
• Report common and repeated problems (trend analysis) to SOC Team lead and propose process and technical improvements.

• Minimum of 3 years of experience in a combination of incident response, information security, and IT.
• Understanding of relevant legal and regulatory requirements, such as Payment Card Industry Data Security Standard.
• Degree in technology-related field preferred, or equivalent work- or education-related experience.
• Professional security management certification is desirable, such as Certified Forensic Investigator (CFI), Certified Forensic Examiner (CFE), Certified Hacking Forensic Investigation (CHFI), GFCA Certified Forensic Analyst (GIAC), or other similar credentials.
• Foundational knowledge of incident response standards such as NIST 80-61, Computer Security Incident Handling Guide, and ISO/IEC 27035:2016, information security incident management.
• Foundational knowledge of information security concepts and technologies such as: networking, network segmentation, vulnerability scanners, firewalls, IPS/IDS, network analyzers, data loss prevention, security event management, encryption technologies, proxies, cloud services, mobile devices, etc.