REQUIREMENTS & COMPETENCIES:
- Bachelor’s degree.
- 3-8 years of experience of working in Security operations and Incident response.
- Hands-on experience with Hunter SIEM platform.
- Hands-on experience with SentinelOne and Microsoft Defender (EDR/XDR).
- Experience in creating detection rules, correlation logic, log onboarding, and SIEM content
management.
- Strong understanding of networking concepts and protocols including TCP/IP, DNS, HTTP/S,
SMTP, VPN, and firewall technologies
- Prior experience detecting, analyzing, and responding to security incidents.
- Demonstrated ability to analyze and correlate information from a wide variety of enterprise
technologies.
- Knowledge of MITRE ATT&CK framework and experience mapping security detections and
incidents to ATT&CK tactics and techniques a plus.
- Familiarity with cloud security monitoring and threat intelligence concepts.
- Strong experience working on scanning tool like Rapid 7.
- Ability to work in a 24x7 rotational SOC environment and handle high-severity incidents.
- Good communication and documentation skills.
RESPONSIBILITIES:
- Provide 24x7 monitoring, detection, triage, investigation, and incident response activities as
part of the Security Operations Center.
- Monitor and analyze security events and alerts across multiple technologies to identify
suspicious and malicious activities.
- Monitor and manage security technologies including Hunter SIEM, SentinelOne, Microsoft
Defender, IDS/IPS, vulnerability scanners (Rapid 7), and related security monitoring tools.
- Conduct proactive threat hunting activities to identify potential threats and indicators of
compromise.
- Investigate security alerts and incidents, determine root cause, and support containment,
remediation, and recovery activities.
- Identify successful and unsuccessful intrusion attempts through event correlation and analysis
across various security platforms.
- Ensure timely escalation and proper hand-off of security incidents for remediation and
closure.
- Develop, maintain, and optimize SIEM use cases, detection rules, filters, and alert
configurations to improve visibility and reduce false positives.
- Onboard and manage log sources and ensure proper log collection and monitoring within the
SIEM platform.
- Monitor SIEM platform health, log ingestion status, and availability of security monitoring
tools.
- Manage and track security incidents and tickets in accordance with defined SLAs.
- Support incident response activities and maintain complete documentation throughout the
incident lifecycle.
- Collaborate with internal teams, application owners, and external vendors to support security
initiatives and projects.
- Participate in shift handover activities to ensure continuity in 24x7 SOC operations.
- Continuously identify and implement opportunities for security process improvement and
enhancement of the organization’s security posture.
Skills Required
- Bachelor's degree
- 3-8 years of experience working in Security Operations and Incident Response (relevant SOC experience)
- Hands-on experience with Hunter SIEM platform
- Hands-on experience with SentinelOne and Microsoft Defender (EDR/XDR)
- Experience creating detection rules, correlation logic, log onboarding, and SIEM content management
- Strong understanding of networking concepts and protocols (TCP/IP, DNS, HTTP/S, SMTP) and VPN and firewall technologies
- Prior experience detecting, analyzing, and responding to security incidents
- Demonstrated ability to analyze and correlate information from a wide variety of enterprise technologies
- Strong experience with vulnerability/scanning tools such as Rapid7
- Ability to work in a 24x7 rotational SOC environment and handle high-severity incidents
- Good communication and documentation skills
- Knowledge of MITRE ATT&CK framework and mapping detections to ATT&CK tactics and techniques
- Familiarity with cloud security monitoring and threat intelligence concepts
What We Do
Photon.com has emerged as one of the world’s largest and fastest-growing Digital Agencies. We work with 40% of the Fortune 100 on their Digital initiatives and are known for our ability to integrate Strategy Consulting, Creative Design, and Technology at scale. Please visit www.photon.com to learn more about us, how we work, and our customer case studies. Digital Transformation Starts Here.
.jpeg)
