SOC Analyst Bangalore

Introduction
Information and Data are some of the most important organizational assets in today’s businesses. As a Security Consultant you will be a key advisor for IBM’s clients analyzing business requirements to design and implement the best security solutions for their needs. You will apply your technical skills to find the balance between enabling and securing the client’s organization with the cognitive solutions that are making IBM the fastest growing enterprise security business in the world.

Your Role and Responsibilities

• EDR alert monitoring.
• Performing TI based and hypothesis driven threat hunting oriented to SIEM logs.
• Support the incident response team during major security incident with advance investigation skills.
• Closely work with SOC team and be responsible for incident detection triage analysis and response.
• Handle L2 and above level technical escalations from L1 Operations team and resolve within SLA.
• Finetune of existing use case of SIEM to reduce false positive.
• Perform and reviews tasks as identified in a daily task list.
• Report Generation and Trend Analysis.
• Walkthrough of the daily weekly and monthly SOC reports to the customer/stake holders.
• Ready to work in 24×7 rotational shift model including night shift.
• Identify the process and technology gaps and drive for closure.
• Explore different technologies available in the security industry.
• Analyse and tune threat monitoring dashboards.
• Coordination with internal customers for their security related problems and providing solutions.
• Create and manage various KEDBs the SOPs runbooks asset inventory with risk classification critical application flow diagram network flow diagram privileged user list.
• Mentor and monitor L1 team members for their daily activities.
• Provide KT and required training to other team members.

Required Technical and Professional Expertise

• 2 to 3 + years of IT experience in security with at least 2+ Years in Security Operation centre with SIEMs and EDR.
• Good to have hands on experience with managing SIEM solutions on public/private clouds like Amazon AWS Microsoft Azure etc.
• Proven Experience on any of the Security information and event management (SIEM) tools like (Qradar Splunk McAfee ESM etc.)
• Data-driven threat hunting using SIEM and other threat hunting tools.
• Experience is SOAR tools such as Qradar Resilient PaloAlto XSOAR
• Identify quick defence techniques till permanent resolution.
• Recognize successful intrusions and compromises through review and analysis of relevant event detail information.
• Launch and track investigations to resolution. Recognize attacks based on their signatures differentiates false positives from true intrusion attempts.
• Actively investigates the latest security vulnerabilities advisories and incidents.
• Identify the gaps in security environment & suggest the gap closure.
• Drive & Support Change Management.

Preferred Technical and Professional Expertise