Security Specialist - SOC

About the role

Logicalis is an international IT solutions provider offering digital enablement services to customers across many industries. Its Security Operations Centre (SOC) identifies, analyses and reacts to cyber security threats, and the Security Specialist joins the SOC team alongside analysts and managers. The role takes an active part in incident detection, hunting and response.

Key responsibilities

• Act as an incident hunter, proactively looking for irregular activity rather than waiting for escalated incidents
• Develop, tune and implement threat detection analytics, and use threat intelligence, IOCs and updated rules to pinpoint affected systems
• Escalate Tier 1 and 2 SOC Analysts, guide them and oversee their work
• Respond to and oversee remediation of declared security incidents, including containment and recovery
• Perform root cause analysis for P1 to P4 incidents and validate findings before closing
• Analyse alerts using SIEM correlation rules, run books and the MITRE ATT&CK framework, and conduct advanced triage
• Validate false positives, policy violations, intrusion attempts and potential compromises
• Monitor shift metrics, gather reports for the SOC Manager and make recommendations
• Manage incidents in the SIEM platform, close tickets (automatically routed to Service Now) and investigate potential incidents
• Support senior SOC staff with operational responsibilities

Required profile

• Grade 12; degree or diploma in Computer Technology
• SIEM technology certification
• Eligible to obtain National Security Clearance
• Strong knowledge of SIEM solutions, Linux, and Microsoft tools; good experience with Nessus or Qualys
• Excellent verbal and written communication, attention to detail, self-motivated and able to work unsupervised

Required skills

• SIEM platforms: QRadar, McAfee ESM, Azure Sentinel
• Office 365, Active Directory, Azure, Microsoft Exchange
• Linux operating systems
• Nessus or Qualys
• MITRE ATT&CK and ITIL frameworks
• Ticketing systems and meeting SLAs
• Advantageous: AZ500, SC100, CompTIA A+, N+, S+, CySa, CISSP, CASP+