Detection Tuning

Incident Detection and Analysis:

• Continuously monitor events generated by our array of security products to proactively identify potential incidents.
• Perform a thorough analysis and investigation of security alerts and escalate to RSOC as needed for official investigation and response.

Tuning and Alert Optimization:

• Conduct regular reviews of alerts to identify false positives and opportunities for reduction
• Analyze alert patterns and trends to optimize detection accuracy and efficiency
• Collaborate cross-functionally with automation and detection teams to implement necessary improvements
• Develop and maintain standardized orchestration processes for alert management
• Escalate potential false positives to relevant stakeholders, providing detailed analysis for informed decision-making
• Continuously refine alert criteria and thresholds to minimize noise while ensuring critical issues are captured
• Document and track alert optimization efforts, including rationale for changes and impact on system performance

Reporting and Documentation:

• Adhere to existing internal documentation and processes, ensuring consistency in work output.
• Identify gaps or outdated information in documentation and proactively update as needed.
• Create new documentation for undocumented processes, maintaining quality standards.
• Continuously improve documentation to enhance team efficiency and knowledge sharing.

• 2 years of experience in a relevant security analyst role and the ability to successfully complete a new analyst training program.
• Proficiency in written communication and a strong grasp of technical concepts.
• Exceptional verbal communication skills and the ability to effectively communicate across different teams.
• A solid understanding of SIEM tools, along with hands-on experience with EDR (Endpoint Detection Response) and EPP (Endpoint Protection Platforms) solutions.
• Competency in network and system security, threat detection, and incident response.
• Outstanding problem-solving, critical thinking, and analytical abilities.
• Capacity to work effectively under pressure in a fast-paced and ever-changing environment.

• Possession of relevant certifications like CompTIA Security+ or Certified Ethical Hacker (CEH) is advantageous.