Specialist, Cybersecurity - SOC

SABIC - Saudi Basic Industries Corp.•Houston, TX

4d•Onsite

About The Position

Provides governance and operational performance oversight of detect, respond, and recovery cybersecurity functions. The primary function is to govern and provider oversight to managed services SOC operations, ensuring effective threat detection, response, and continuous improvement across IT and OT environments. The role includes management of cybersecurity controls, platforms, tooling, and managed services related to threat management and incident detection, response, and recovery. Key responsibilities include incident governance, threat detection, threat intelligence, threat hunting, and managing and maintaining operational playbooks, metrics, exercises, and incident reporting. This role acts as the domain authority for cybersecurity operations relate to cybersecurity incidents, and identifies, analyzes, communicates, contains, and recovers from cyber incidents as they occur. The role is responsible to run, manage, and maintain existing cybersecurity control platforms and tooling, as well as to plan and execute projects to improve existing solutions and to introduce new capabilities and controls in alignment with the department's strategy and roadmap.

Requirements

Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field.
5+ years of experience with regulatory compliance and information security management frameworks (such as International Organization for Standardization [ISO] 27000, COBIT, National Institute of Standards and Technology [NIST] 800)
8-10 years in SOC /Incident Response
Strong understanding of SIEM, SOAR, EDR
Strong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one.
An ability to effectively influence others to modify their opinions, plans or behaviors.
An understanding of organizational mission, values, goals and consistent application of this knowledge
Strong problem-solving and troubleshooting skills.
Knowledge of firewalls, intrusion detection systems, intrusion prevention systems, security information and event management (SIEM) systems, security orchestration, automation, and response (SOAR) platforms, and other security tools and technologies
Project Management
Change Management
Personal Leadership
Strong Communication
Drive for Results
You must be 18 years or older
Applicants must be currently authorized to work for SABIC in the United States on a full-time basis.
Regular, predictable attendance is an essential function of this position. Applicants must be regularly available and willing to work (e.g. Monday – Friday)] during assigned hours of operation and such other hours as the company determines are necessary or desirable to meet business needs

Responsibilities

Service owner for managed security service provider performance, SLAs, and service quality across all capabilities related to cybersecurity threat detection, incident response, and recovery, including service reviews and overseeing SOC operations on a daily basis.
Govern major incident response, including identification, containment, eradication, recovery, root cause identification, and post-incident reviews.
Focal point for coordinating communications related to cybersecurity threats, events, incidents, and recovery activities.
Escalation point for any issues with SOC-related services and controls
Define use cases, detection rules, and threat coverage priorities.
Define standards and use cases for IT and OT log integrations with SOC operations.
Manage and maintain log management and SIEM ingestion platforms and process.
Manage and maintain SIEM use cases, standards, operational playbooks, and reporting.
Ensure threat intel is operationalized into SOC processes.
Review threat intel sources for integration
Deliver threat intelligence advisories and briefings to key stakeholders based on their areas of interest, such as OT threats to manufacturing cybersecurity focal points.
Deliver executive reporting on incidents, trends, and risks.
Deliver executive reporting on threats and state of cybersecurity internally, within the industry, and of interest to the business.
Provide custom reports and dashboards to cybersecurity, IT, and OT stakeholders driven by cybersecurity log and SIEM tooling.