Soc Analyst

Role & responsibilities

Job Description: SOC Analyst (L1 & L2)

Jan 16, 2025

SOC Analyst (L1 & L2) - Desired Skills and Qualifications

We are seeking a candidate with the following skills and expertise to join our Security Operations Center (SOC) team:

Technical Skills

1. Networking & Protocols:
• Strong understanding of networking concepts, including protocols, headers, subnetting, routing, and addressing.
2. Operating Systems:
• Proficiency in both Linux and Windows operating systems.
• In-depth knowledge of Linux architecture, commands, and system security.
• Strong understanding of Active Directory (AD), including its architecture and common attack vectors.
3. Linux Security:
• Knowledge of Linux system attacks and hardening techniques.
• Ability to detect and prevent Linux local and remote exploits.
• Understanding of privilege escalation methods and how to mitigate them in Linux environments.
4. Cybersecurity Knowledge:
• Familiarity with OWASP's Top 10 vulnerabilities and their mitigation strategies.
• Basic understanding of digital forensics and malware analysis methodologies.
5. Incident Response & Threat Detection:
• Hands-on experience in incident response and handling, including triage and investigation.
• Skilled in using ELK (Elasticsearch, Logstash, Kibana) for log analysis, threat hunting, and visualization.
• Proficiency in crafting security rules and use cases for enhanced detection.
6. Threat Intelligence & Simulation:
• Experience in gathering, analyzing, and leveraging threat intelligence.
• Ability to simulate threats and conduct exercises to assess detection and response capabilities.
7. Tools & Platforms:
• Strong expertise in tools like ELK Stack, TheHive, Cortex, MISP, OpenCTI, and Jira.
• Hands-on experience with case management and workflow tools.
• Proficiency in query languages like KQL and ESQL for detailed log analysis.
8. Security Use Case Development:
• Writing custom detection rules for OWASP Top 10 vulnerabilities, Active Directory attacks, and Linux-specific threats.
• Development and refinement of use cases to enhance SOC monitoring and detection capabilities.

Soft Skills

1. Problem-Solving:
• Ability to critically analyze and solve complex security challenges.
2. Communication:
• Strong documentation and reporting skills to effectively communicate findings.
3. Team Collaboration:
• Ability to work in a dynamic, fast-paced environment and collaborate with cross-functional teams.

Preferred Qualifications

1. Certifications such as CompTIA Security+, CEH, BTL1, OSDA, or equivalent.
2. Prior experience in a SOC or similar cybersecurity-focused role.
3. Familiarity with security frameworks such as MITRE ATT&CK and NIST CSF.

Key Responsibilities for the Role

1. Monitoring & Response:
• Continuous monitoring of security alerts and logs for threats.
• Real-time incident response and mitigation of potential breaches.
2. Incident Handling:
• Triage and investigate incidents using digital forensics and malware analysis tools.
• Document findings and lessons learned.
3. Threat Prevention:
• Hardening Linux and Windows systems against known vulnerabilities.
• Proactively identifying and addressing potential attack vectors.
4. Collaboration:
• Work closely with other teams to ensure the security of IT infrastructure.
• Create detailed reports and summaries for stakeholders.
5. Tool Management:
• Manage and optimize security tools, including ELK, TheHive, Cortex, MISP, OpenCTI, and Jira.