- 3-6 years of experience in SOC Incident response and handling.
- Should be working in SOC, SIEM technologies (preferrable Qradar)
- EDR/XDR solutions (CrowdStrike, Cortex XDR, Microsoft Defender)
- Review and triage information security alerts worked by L1/L2, provide analysis, determine and track remediation, and escalate as appropriate.
- Desirable to have experience of SOC Monitoring and tirage using SIEM technologies (LogRhythm, Splunk, Sentinel, Chronicle)
- Knowledge on XDR can be an added advantage
- Knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management etc.
- Fundamental understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
- Reviews the most recent SIEM alerts to see their relevance and urgency. Carries out triage to ensure that a genuine security incident is occurring. Oversees and configures security monitoring tools.
- Robust understanding of Recorded Future Fusion, Brand protection cloud side..
- Inform L4 team of proactive and reactive actions to minimize false positives.
- Maintain, manage, improve and update security incident process and protocol documentation (Run Book).
- Strong understanding of Windows event log analysis.
- Candidate must be willing to work from Nagpur location.