Title: Level 2 SOC Analyst
Location: Brussels, on site
Work Arrangement - Shift pattern required + on call
Job type: Full-Time Permanent
About Us
Integrity360 is a leading independent cybersecurity and PCI specialist operating across Europe, Africa, the Caribbean, and North America. The company has office locations in Ireland, the UK, Bulgaria, Italy, Sweden, Spain, Lithuania, Ukraine, Africa, the Caribbean, and Canada, supported by seven Security Operations Centres (SOCs) located in Dublin, Sofia, Madrid, Stockholm, Rome, Johannesburg and Cape Town.
With over 780 employees, including more than 585 dedicated cybersecurity professionals, Integrity360 delivers a full suite of professional, support, and managed security services. These span the complete cyber risk lifecycle, from identification and prevention to detection, response, and recovery. Integrity360 supports over 3000 mid-market and enterprise organisations across sectors including financial services, insurance, government, healthcare, retail, telecommunications, and utilities.
At Integrity360, people come first. We invest heavily in learning, development and progression, fostering a dynamic culture where innovation, collaboration and continuous growth are at the heart of what we do. If you're ready to take your cyber security career to the next level, we’d love to hear from you.
Job Role / Responsibilities
In this role you will be expected to analyse a range of alerts and incidents, identifying threats and attacks performed by Threat Actors ranging from cyber criminals, ATPs, and Nation States. You will leverage various threat intelligence streams to enhance your understanding of emerging threats and vulnerabilities used by Threat Actors, providing customers with your insight and experience. You will act as a core investigator for security incidents and alerts, escalating to senior SOC staff when a true positive has been identified. A successful security analyst will verify security events as security incidents; correlate and collate the information; and effectively escalate their findings and recommendations internally, or to the customer.
The role requires flexibility and the ability to work as part of a wider shift pattern, additionally, there may be an on-call aspect required. A good knowledge of Information Security is required for this role. Proactive client services, such as compromise assessments and evaluating and recommending tools and technology for incident response are also in scope. Demonstration of a strong comprehension of malware, emerging threats and adversary TTPs will be critical to success.
Primary Duties/Responsibilities include:
- Analyse security alerts and incidents, following defined investigation processes to determine the risk they present and impact to customers.
- Perform ad-hoc analysis of varied logs, identifying anomalies in customer environments.
- Perform in-depth investigation on confirmed security incidents, assisting senior SOC analysts to mitigate threats.
- Identify threats, perform mitigating actions to contain and eradicate threats in the environment.
- Identify and document tuning opportunities for senior SOC analysts to perform
- Assist in the report creation process, performing enriching queries and investigations to help produce a high quality incident report for core stakeholders.
- Assist in development of varied customer reports such as Emerging Threat reports, Incident Response reports, consistent MDR reports.
- Assist in CSOC continuous improvement and development initiative to maintain and improve core processes, SOPs, and documentation.
Desired Skills
- Experience working with security event detection tools like IPS, SIEM, DLP, Anti-virus, etc.
- Ability to perform event correlation, host/ network threat analysis.
- Ability to manage multiple incidents and make effective decisions under high pressure environment.
- Experience in performing analysis on network pcaps and documents for malicious activity or codes.
- Conceptual knowledge in Networks and Network Security.
- Understanding of Network infrastructure hardware and protocols (TCP/IP, switches, bridges, routers, proxy servers, VPN concentrators).
- Understanding of Security protocols (IPSec), and encryption technologies (3DES, AES, SHA2, TLS).
- Understanding of basic security principles such as Confidentiality, Availability, Integrity.
- Familiar with security best practices.
- A process of on-going certification for the benefit of the business and for self-development is encouraged .
- Review the adequacy of the security controls and their ability to protect the information system and its information.
- Experience with Splunk is a plus.
- Experience using SIEM & IPS solutions is a plus.
- Strong Microsoft Word & Microsoft Excel skills required.
- Proficiency in an additional European language (e.g. Dutch, French, German, or Spanish) preferred
Certifications/Qualifications
- Security industry certifications: SEC+, CYSA+, Net+, SC-200,AZ-500,AZ-900,Splunk Power user
- A working knowledge of Intrusion Prevention System (IPS), SIEM, SOAR & DLP is a nice to have.
- Experience working with threat hunting tools is nice to have.
Skills Required
- Experience with security event detection tools such as IPS, SIEM, DLP, and antivirus
- Ability to perform event correlation and host/network threat analysis
- Ability to manage multiple incidents and make effective decisions under pressure
- Experience analyzing network packet captures and documents for malicious activity or code
- Conceptual knowledge of networks and network security
- Understanding of network infrastructure hardware and protocols, including TCP/IP, switches, bridges, routers, proxy servers, and VPN concentrators
- Understanding of security protocols and encryption technologies, including IPSec, 3DES, AES, SHA-2, and TLS
- Understanding of confidentiality, availability, and integrity principles
- Familiarity with security best practices
- Strong Microsoft Word and Microsoft Excel skills
- Review security controls and their ability to protect information systems and information
- Proficiency in an additional European language such as Dutch, French, German, or Spanish
- Security certifications such as Security+, CySA+, Network+, SC-200, AZ-500, AZ-900, or Splunk Power User
- Working knowledge of IPS, SIEM, SOAR, and DLP solutions
- Experience with Splunk
- Experience using SIEM and IPS solutions
- Experience with threat hunting tools
What We Do
Integrity360 is one of Europe’s leading cyber security specialists operating from office locations in the UK, Ireland, Bulgaria and Sweden. The group provides a comprehensive range of professional, support and managed cyber security services that identify and assess, protect and prevent, detect and analyse and respond and recover cyber risks and threats. Working either independently or as an extension of a organisations own team Integrity360 strengthen security postures for both mid market and enterprise organisations across a wide range of sectors including financial services, insurance, government, healthcare, retail, telecoms and utilities. During June 2021 the company received a major strategic investment from leading London based private equity firm August Equity as part of a significant growth and expansion plan that will build the brand international With four Security Operation Centres, the company offers a complete end-to-end security services offering to its clients, covering their security from every angle. Its services include Managed Security, Cyber Security Testing, Incident Response, Security Integration and Cyber Risk & Assurance services. Its 300 clients can be found in all business verticals and include some of the largest and most well-known brands in the country. What sets Integrity360 apart is its excellent team of people that drive the business forward. The company was founded with a focus on technical expertise and that philosophy remains today. The skills and experience in the company are some of the greatest in the industry and clients remain with Integrity360 because they can rely on and trust them to go above and beyond to ensure their needs are met. Integrity360 is listed multiple time in the Gartner Market Guides for Managed Security Services.
