Security Operations Analyst (24×7)

Full Time | Remotely within Asia-Pacific (APAC) Region

If you like this offer, please send your CV mentioning the job title to: [email protected]

Location: Remotely within Asia-Pacific (APAC) Region

Teleworking option: Yes

Required Technical Skills

SCOPE OF WORK:
• Monitor and investigate alerts leveraging Microsoft Security Tools (e.g. M365, Cloud App

Security, Azure, Defender for Endpoint, Azure Security, Azure Sentinel and XDR)
• Monitor and triage AWS security events and detections
• Monitor and investigate alerts leveraging EDR and NDR solutions
• Review security events that are populated in a Security Information and Event Management (SIEM) system
• Analyze a variety of network and host-based security appliance logs (Firewalls, NIDS, HIDS, Sys Logs, etc.) to determine the correct remediation actions and escalation paths for each incident
• Identify incident root cause and take proactive mitigation steps
• Assist with incident response efforts
• Follows precise analytical paths to determine the nature and extent of problems being reported by tools, e-mails, alerts, etc.
• Integrate and share information with other analysts and other teams
• Determine and direct remediation and recovery efforts.
• Provide other ad hoc support as required

The resource MUST have the following skills and experience:
• Knowledge of Transmission Control Protocol / Internet Protocol (TCP/IP) protocols
• Deep knowledge of Microsoft Security Tools (e.g. M365, Cloud App Security, Azure, Defender for Endpoints, Azure Security, Azure Sentinel and XDR)
• Deep Knowledge of Cloud technologies (e.g. Azure, AWS and GCP)
• Deep knowledge of SIEM tools like Splunk, QRadar, ArcSight, MS Sentinel, ELK Stack
• Knowledge of at least one EDR solution (MS Defender for Endpoint, SentinelOne, CrowdStrike)
• Knowledge of email security, network monitoring, and incident response
• Knowledge of Linux/Mac/Windows
• A minimum of five (5) years of relevant experience in information technology field, including triage of alerts and supporting security incidents
• Proven experience with the usual toolbox available in a SOC (e.g., SIEMs, EDRs), able to autonomously perform technical analysis of security threats and collaborate with Incident Response team
• Trouble ticket generation and processing experience
• Extensive Windows, Linux, Database, Application, Web server, etc. log analysis
• Expert knowledge of English, both written and spoken, is required

The resource SHOULD have the following skills and experience:
• Experience on an Incident Response team performing Tier I/II initial incident triage.
• Proven knowledge of monitoring AWS environment (Iaas, Saas, Paas)
• Knowledge of at least one general-purpose or shell scripting language (e.g. Ruby, Bash, PowerShell, Python, etc.)

Soft skills:
• Excellent communication skills
• Customer-facing experience and oral communication skills
• Ability to write documentation & reports
• Creativity/ ability to find innovative solutions
• Willingness to learn on the job
• Conflict management & cooperation

Desirable certifications:
• Technical certifications: MCSE, CCNA, Microsoft Azure (e.g., SC-200), GCIH, CEH, GCFA or any GIAC/similar certification
• Relevant industry certifications

Teleworking Option:
• Yes

On-call requirements:
• Not required