Cyber: D&R I Assistant Manager | SOC - SIEM

The team:

Deloitte helps organizations prevent cyberattacks and protect valuable assets. We believe in being secure, vigilant, and resilient-not only by looking at how to prevent and respond to attacks, but at how to manage cyber risk in a way that allows you to unleash new opportunities. Embed cyber risk at the start of strategy development for more effective management of information and technology risks.

Your work profile:

Review and triage information security alerts worked by L1, provide analysis, determine and track remediation, and escalate as appropriate.

Responsibilities:

• Knowledge of security concepts such as cyber-attacks and techniques, threat vectors, risk management, incident management, etc.
• Fundamental understanding of network traffic analysis including TCP/IP, routing, switching, protocols, etc.
• Review the most recent SIEM alerts to see their relevance and urgency.
• Carry out triage to ensure that a genuine security incident is occurring.
• Oversee and configure security monitoring tools.
• Maintain, manage, improve, and update security incident process and protocol documentation (Run Book).
• Strong understanding of Windows event log analysis, Recorded Future Fusion, and brand protection cloud side.
• Act as Security Incident Handler for high-impact cyber security incidents and advanced attacks in accordance with Cyber Kill Chain methodology and incident response process.
• Conduct malware analysis and identification of Indicators of Compromise (IOCs) to evaluate incident scope and associated impact.
• Enhance workflow and processes driving incident response and mitigation efforts.
• Practical understanding of exploits, vulnerabilities, computer network intrusions, adversary tactics, exfiltration techniques, and common knowledge.
• Demonstrate proficiency in the Incident Response Process as well as the performance of threat hunting and SOC operations.
• Perform log analysis across disparate log sources, prioritize, and differentiate between potential intrusion attempts and false alarms.
• Sound understanding of different attack frameworks like Kill Chain and MITRE and ability to utilize them for incident response and reporting.
• Review and triage information security alerts worked by L1/L2, provide analysis, determine and track remediation, and escalate as appropriate.
• Inform L4 team of proactive and reactive actions to minimize false positives.

Key responsibilities:

• 4-6 years of experience in SOC incident response and handling.
• Should be working in SOC and SIEM technologies (LogRhythm, Splunk, Sentinel, Chronicle).
• EDR/XDR solutions (CrowdStrike, Cortex XDR, Microsoft Defender).
• Desirable to have experience of SOC monitoring and triage using SIEM technologies (LogRhythm, Splunk, Sentinel, Chronicle).
• Knowledge on XDR can be an added advantage.
• Preferably possess at least one of the following certifications: CompTIA Security+, ECSA, GCFA, GCFE, CISSP.
• Bachelor's or Master's degree in Computer Science, Information Security, or related field.
• Professional is required to work from office.
• Candidate shall be willing to work from Nagpur location.