Security Information and Event Management (SIEM) :
Manage and operate SIEM systems (Splunk, ELK) for real-time security event monitoring and analysis.
Create, refine, and maintain SIEM correlation rules to identify potential security incidents.
Conduct threat hunting activities to proactively identify and mitigate potential security risks.
Endpoint Detection and Response (EDR) :
Manage and utilize EDR solutions (Crowdstrike) for endpoint threat detection, investigation, and response.
Analyze EDR alerts to identify suspicious activity and potential malware infections.
Remediate endpoint threats according to established procedures.
Service Now/Remedy and SOAR tools :
Utilize ticketing systems (ServiceNow/Remedy) to document, track, and manage security incidents.
Work with SOAR tools to automate incident response workflows and improve efficiency.
Storage Management :
Manage Network Attached Storage (NAS) devices for secure storage of security data.
Cloud Security :
Possess a strong understanding of cloud security principles and best practices (Azure/AWS).
Cybersecurity Expertise :
Demonstrate a deep understanding of various cyberattacks, techniques, and procedures (TTPs).
Analyze event logs, conduct forensic investigations using tools like Wireshark/Nmap/TCPdump.
Technical Skills :
Possess a thorough understanding of diverse telecommunications and infrastructure technologies (5G, 4G, Fixed line).
Proficient with Windows, Unix, and various security tools (NGFW, IDS/IPS, AV/EDR, Proxy).
Familiar with the SOC operation process, incident lifecycle, and the NIST cybersecurity framework.
Threat Intelligence :
Stay informed about current attacker trends, threat actor tools, and Indicators of Compromise (IOCs).
Integrate threat intelligence feeds into SIEM to enhance threat detection capabilities.
Incident Management and Response :
Contribute to the overall security incident management process, including threat hunting, vulnerability management, endpoint detection and response, and security event monitoring.
Investigate security incidents, conduct root cause analysis, and implement appropriate remediation actions.
Own and manage security incident tickets, ensuring timely resolution and closure.
Reporting and Analysis :
Generate reports for weekly/monthly dashboards, audit purposes, KPIs, and root cause analysis (RCA) of critical incidents.
Process Management :
Create and manage trouble tickets (TTs) within established ticketing systems.
Correlate incidents or problems and assist L3 analysts in investigations.
Recommend improvements to use cases (UCs) for enhanced security posture.
Threat Awareness and Communication :
Stay updated on threat advisories and share relevant information with the team.
Enrich SIEM with new IOCs based on threat intelligence updates.
Technical Support :
Provide technical security support to various teams during incident response and remediation activities.
Documentation and Procedures :
Document and update playbooks and other operational procedures to ensure clarity and consistency.
Soft Skills :
Excellent communication and technical writing skills for conveying complex technical information to diverse audiences.
Action-oriented and results-driven with strong time management skills.
Flexible, reliable, and possess excellent problem-solving and analytical skills.
Thrive in a team environment and demonstrate excellent interpersonal skills.

Network SOC L2 Analyst - SIEM|Gurgaon|4+Yrs

Job Description & Responsibilities

About Overture Rede

Job Details

Posted by

About Overture Rede

More open roles