Senior SOC Analyst

Ciena Corp.•Manila, AR

57d•Hybrid

About The Position

As the global leader in high-speed connectivity, Ciena is committed to a people-first approach. Our teams enjoy a culture focused on prioritizing a flexible work environment that empowers individual growth, well-being, and belonging. We're a technology company that leads with our humanity-driving our business priorities alongside meaningful social, community, and societal impact. The Security Organization The Security team at Ciena is a tightly knit group of skilled professionals who share the same passion for defending against cyber criminals. With the increase in volume and sophistication of cyber-crime, we are growing and have tons of exciting work planned. Your Role In this role, the Senior SOC Analyst will respond to and actively monitor for security events. The analyst will perform tasks including monitoring, research, classification, and analysis of security events that occur on the network or endpoint. This may require working extra hours on an as needed basis. You will be expected to detect and respond to information security incidents, develop, maintain, and follow procedures for security event alerting, and participate in security investigations. You need to have hands-on experience with email, endpoint, network threat detection, remediation, and threat hunting. You should have familiarity with the principles of network and endpoint security, current threat and attack trends, a basic understanding of the OSI model, and have a working knowledge of defense in depth strategies. You will be responsible for various activities within the security incident response lifecycle including detection, analysis, containment, eradication, recovery, and incident post-mortem reviews. You will be expected to thoroughly document their investigations and response actions within the SIEM and ticketing platform. You will assist with development of new security alerts and tuning existing alerts for improving detection accuracy. will also be responsible for performing proactive threat hunting, vulnerability, and threat intelligence research as well as reviewing threat intelligence reports from our security partners.

Requirements

Ability to read, write, speak and understand the English language to communicate with employees, customers, suppliers, in person, on the phone, and by written communications in a clear, straightforward, and professional manner
Experience working with multiple SIEM, EDR, Log Aggregators, and Incident Response Management solutions
Strong technical knowledge of Networking, Operating Systems, and enterprise integrations
Firm understanding of the security incident lifecycle
Thorough understanding of TCP/IP
Understand IDS / IPS rules to identify and/or prevent malicious activity
Basic knowledge of forensic methodologies and best practices to investigate intrusions, preserve evidence and coordinate a unified security response
Ability to proactively perform threat hunting to identify undetected security events
Basic knowledge of malware analysis
Basic understanding of SQL
Understanding of Packet Analysis (PCAP) and Packet Analysist software

Nice To Haves

Bachelor's degree in Cybersecurity, Computer Engineering, Information Technology, or related field.
Candidate will possess ability to be a successful self-starter
Understanding of Advanced Persistent Threats
Experience with Python, PowerShell, and API programming is a plus
Understanding of the VERIS and MITRE ATT&CK frameworks is a plus

Responsibilities

Monitor SIEM, EDR, and other security tools for detection and identification of security events
Document security investigations in a clear and consistent manner
Develop new use cases for security alerts
Tune existing use cases to improve accuracy
Tune endpoint and network security tools as needed
Perform threat hunting to identify potential security threats
Perform vulnerability and threat intelligence research
Review threat intelligence reports
Ability to work after hours if needed
Perform security anomaly and event detection
Investigate, contain, and resolve security anomalies and events
Perform threat attribution
Identification of likely threat vector for security events and incidents