L3 SOC Analyst

Key Requirements

• Strong L3 SOC / Security Operations experience within a commercial environment.




• Proven experience with SIEM onboarding, configuration, tuning, optimisation and use-case development.




• Strong Security Monitoring, Incident Response and Threat Intelligence experience.




• Experience performing advanced event and incident analysis, including baseline and trend analysis.




• Commercial experience in Penetration Testing and/or Security Monitoring.




• Experience providing technical leadership, mentoring and guidance to L2/L3 SOC analysts.




• Strong understanding of networking, infrastructure, operating systems and security architecture.




• Experience across Windows, Linux and/or Mac system administration.




• Experience supporting Major Incident Response, including threat identification, containment and remediation.




• Ability to communicate complex security issues effectively to technical and non-technical stakeholders.




• Active SC Clearance or ability to obtain SC Clearance.

Key Technical Skills

• SIEM: Microsoft Sentinel, IBM QRadar, LogRhythm




• Microsoft Security: Microsoft Defender for Endpoint, Microsoft Defender for Identity and Cloud




• Microsoft Sentinel: KQL, use-case development, detection rules, workbooks, playbooks




• SOAR: Logic Apps and security automation




• MSSP / Multi-Tenant: Microsoft Sentinel Lighthouse, multi-customer environments and DevOps




• Threat Intelligence: Open-source and commercial intelligence




• Security Monitoring: Alert analysis, detection engineering, rule creation, tuning and optimisation




• Incident Response: Advanced investigation, containment, remediation and Major Incident Response




• Infrastructure: Networking, operating systems and infrastructure design




• Log Management: Log-source assessment, parsing, onboarding and monitoring




• Automation: SOAR, playbook development and process improvement

Certifications

Relevant industry certifications are highly desirable, including:

• CompTIA Network+




• CompTIA Security+




• CompTIA CySA+




• CISMP




• CISSP




• Other relevant SOC, SIEM, Cyber Security or Protective Monitoring certifications

Must hold UK, EU or Irish passport – Must be in Belfast – this is a hybrid role 2 days per week

#J-18808-Ljbffr…