Public Sector SOC Analyst

Verizon•Cary, NC

3d•$75,500 - $135,000•Hybrid

About The Position

This role is for overnights - 5 eight hour shifts from 11:45 p.m. - 8 a.m. with two weekends (both Saturday and Sunday) a month. As a Security Analyst for Verizon's Public Sector SOC, your primary responsibility is to ensure our customers receive professional service and prompt response to their network incident response needs. You will monitor SEM alerts, initiate and work incident management tickets, and respond to trouble calls and emails from customers. You are often the first to see an issue, or the issue may have been escalated from another team/management. Job functions include security incident analysis (60%) change management (10-20%), performing device and health monitoring as well as systems maintenance (10-20%). Our SOC Analysts provide critical value to the Security Incident and Event Management (SIEM) workflow, leveraging their extensive knowledge to provide context to events. Tier-2 SOC Analysts additionally provide recommendations for remediation actions and suggestions for implementing best practices and improving standard processes and procedures.

Requirements

Associate's Degree or two or more years of work experience
Three more more years of work experience as a Security Operations Analyst researching and solving network threat incidents
Must be able to qualify for and maintain a U.S. government security clearance at the Public Trust level
Must be able to work the overnight shift of 11:45 p.m. - 8 a.m. 5 days a week and be able to work your assigned two weekends (both Saturday and Sunday) each month.
Three or more years of hands on experience using a Security Incident Event Management (SIEM) for analytics
Three or more years of experience investigating security incidents with SIEMs, use case development/tuning, and understanding of incident response
Three or more years of experience with incident response techniques related to network forensic analysis
Three or more years of experience with scripting, parsing, and query development in enterprise SIEM solutions
Three or more years of experience in tuning use cases & content, driven from day to day optimizations, with understanding of best practices to ensure adjustments do not cause false negatives
Experience with health and availability monitoring; understanding of device logging and ingestion, network troubleshooting, and device troubleshooting
Experience with Linux command line
Experience with IPS including analyzing alerts generated by the inspection with consideration to how signatures are written, and how to identify false positives
Experience with next generation firewalls including firewall policy & content inspection configuration (Fortimanager, Fortigate, Cisco, Palo Alto, Checkpoint, etc.)

Nice To Haves

Bachelor's or Master's Degree in Computer Science or other technical field
Security industry certifications such as CISSP, SANS GIAC or GCIH, CompTIA Security+, CCNP-Security, Palo Alto CNSE, Fortinet NSE, CySA+, GCED, CEH, or comparable security-related certification
Experience with documenting processes and procedures as well as training team members on processes and procedures
Exceptional problem solving skills
Ability to drive process improvements and identify gaps
Proactive in engaging with customers and Verizon management teams
Thorough understanding of threat landscape and indicators of compromise
Scripting knowledge in (ie. Python, Powershell, Bash Shell, Java, etc.)
Experience with customer service and supporting service desk functions such as IAM

Responsibilities

Provide “eyes on glass” near real-time security monitoring in a 24x7 environment by monitoring security infrastructure and security alarm devices for Indicators of Compromise utilizing a proprietary SIEM and cybersecurity tools;
Perform near real-time security monitoring of alerts and escalating critical alerts in compliance with the service level agreement;
Detect security incidents and analyze threats for complex and/or escalated security events;
Perform level 2 assessment of incoming alerts (assessing the priority of the alert, determining severity of alert in respect to customer environment, correlating additional details) and coordinate with Tier-3 for critical priority incidents, if necessary;
Perform incident response activities utilizing customer SIEM and cybersecurity toolkits;
Respond to customer Requests For Information including using Linux command line skills to query raw logs for IOCs, answering questions about the MSS infrastructure, and features of the SIEM including correlation engine while recommending best practices;
Develop internal and/or external documentation, such as detailed procedures, playbooks, and runbooks; review and assess reports concerning operational metrics;
Assist with quality control during onboarding of new customers to verify validity of Use Cases and generated alerts;
Utilize the SOC Knowledge Base and provide input on revisions as needed