SOC Analyst

ITC Secure

1d•Remote

About The Position

As a member of a team of Security Analysts and Network and Security Engineers within ITC’s Security Operations Centre (SOC), you will provide security analysis of customer security events, monitor and investigate incidents in customer environments with a focus on security event management, vulnerability management, behavioural analytics and MDR for a portfolio of blue-chip and mid-market customers. The role involves analysis and investigation of alerts arising from Security Event and Information Management tools, Network Behaviour Analytics tools, vulnerability scanning and reporting, utilising Intrusion Prevention solutions, analysing packet flows using packet-capture tools and network-based User Behaviour Analytics, and using Threat Intelligence Services to identify potential new threats and develop new mitigations. You will also work with customer security teams to detect, contain and eradicate threats, and have an understanding of security assessment and penetration testing tools. Other duties may be required from time to time.

Requirements

COMPTIA Security+ certification
Experience across two or more cybersecurity domains
Experience with Security Monitoring & Threat Detection Platforms (e.g., Microsoft Sentinel)
Experience with Endpoint Detection, Response & Managed Security Services (EDR/XDR/MDR)
Experience with Network Detection & Behaviour Analytics (e.g., Darktrace, IronNet)
Experience with Vulnerability Management & Remediation
The ability to communicate fluently and confidently to a high standard in both written and verbal English
Has a passion for learning to better themselves and their department
Has the desire to translate their skills into ways that can improve the function of the Operations Centre
Enjoys research into emerging threats in the security landscape and identifying and analysing real-world threats
Works collaboratively, shares information, improves documentation and trains colleagues

Nice To Haves

Microsoft SC-200 certification
Microsoft AZ-500 / SC-500 certification
Exposure working with a previous managed security provider or within an MSSP environment
Experience using ITSM tools
Knowledge and understanding of MITRE ATT&CK Framework

Responsibilities

Analysis and investigation of alerts arising from Security Event and Information Management tools
Analysis, investigation and refinement of alerts and reports arising from Network Behaviour Analytics tools
Vulnerability Scanning and reporting. Prioritising and tracking remediation of vulnerabilities
Utilising Intrusion Prevention solutions to monitor and alert on potential breaches
Using packet-capture tools, analyse packet flows and utilise network-based User Behaviour Analytics to understand breaches and track propagation of malware
Using Threat Intelligence Services to identify potential new threats and develop new mitigations
Working with customer security teams to detect, contain and eradicate threats
Understanding of security assessment and penetration testing tools
Undertaking other duties from time to time as required