security analyst in enterprise security operations

Описания нет

• Monitor on-prem and AWS infrastructure for attacks, intrusions, and unusual, unauthorized, or illegal activity
• Monitor identity and access management, including potential abuse of permissions by authorized system users
• Create SIEM and SOAR detection and remediation scenarios and implement them as rules
• Create, test, and update playbooks
• Perform threat hunting and support threat intelligence processes
• Carry out other security operations activities alongside security monitoring
• Generate reports for technical and non-technical staff and stakeholders
• Use advanced analytic tools to identify emerging threat patterns and vulnerabilities

• 1+ Years of experience with SIEM solutions such as Splunk, QRadar, ArcSight, LogRhythm, ELK, or Wazuh
• Experience with SIRP/SOAR tools such as TheHive, Cortex, Phantom, XSOAR, or Resilient
• Knowledge of Internet security, networking protocols, and related technologies, including IDS/IPS, firewalls, and content filtering
• Familiarity with Network Behavior Analysis tools, anti-malware, and packet inspection
• Understanding of Windows, Linux, database, and network device monitoring and logging techniques
• Understanding of host and network security hardening, networking protocols, common intrusion techniques, and common risk management concepts
• Knowledge of malware detection, intrusion detection, and prevention systems
• English proficiency at B2+ level
• Будет плюсом: AWS experience, network security experience, experience with firewalls such as F5, Juniper, Check Point, Palo Alto, or Cisco

• Shift rotation: 2 days on, 2 days off, 12 hours per shift, including 11 work hours and 1 hour for rest