Profile

• The primary function of the Senior Incident Responder - SOC Analyst is to manage any incidents escalated by the SOC Analyst (L1 & L2) and undertake the detailed investigation of the Security Event.  They will able to look at all the evidence available and support the client on the appropriate action to contain and remediate any security incident. They will need to be able to provide root cause analysis and liaise with the customer and the Service Delivery Manager as well and ensuring the actions of the SOC Analysts follow best practice.

Job Duties

• Security Monitoring: & Investigation:
  • Monitoring SIEM tools to assure high a level of security operations delivery function
  • Oversee and enhance security monitoring systems to detect and analyse potential security incidents.
  • Conduct real-time analysis of security events and incident and escalate as necessary
  • Support investigations into incidents, determining the root cause and impact.
  • Document findings and lessons learned to improve incident response procedures.
  • Ensure runbooks are followed and are fit for purpose
• Incident Response:
  • Perform static and dynamic malware analysis to determine behaviour, indicators of compromise (IOCs), and potential impact.
  • Reverse engineer malware samples to understand functionality and develop detection signatures.
  • Ensure chain-of-custody procedures are followed during evidence handling and documentation.
  • Lead and coordinate incident response activities to effectively contain, eradicate, and recover from security incidents.
  • Escalation management in the event of a security incident
  • Manage and support technical handover to Forensics, and law enforcement teams.
• Threat Intelligence:
  • Stay abreast of the latest cybersecurity threats and vulnerabilities, integrating threat intelligence into security monitoring processes.
  • Contribute to the development of threat intelligence feeds to enhance proactive threat detection.
• Security Tool Management:
  • Manage and optimise SIEM tools, ensuring they are properly configured and updated to maximize effectiveness.
  • Own the development and implementation of SOC Use Cases
  • Evaluate new security technologies and recommend enhancements to the security infrastructure.
• Collaboration:
  • Collaborate with cross-functional teams, including IT, legal, and management, to address security incidents and implement preventive measures.
  • Provide expertise and guidance to other analysts.
  • Working with the Technical Teams to ensure all new and changed services are monitored accordingly
• Documentation:
  • Maintain accurate and up-to-date documentation of security procedures, incident response plans, and analysis reports.
  • Create post-incident reports for management and stakeholders.
  • Support the creation of monthly reporting packs as per contractual requirements.
  • Create and document robust event and incident management processes, Runbooks & Playbooks
• Other responsibilities:
  • Involvement in scoping and standing up new solutions for new opportunities
  • Assisting Pre-Sales team with requirements on new opportunities
  • Demonstrations of SOC tools to clients
  • Continual Service Improvement - Recommendations for change to address incidents or persistent events.