[Hiring] SOC Analyst I / II @ProCircular

Role Description

We are hiring for this role at either the SOC Analyst I or SOC Analyst II level. The level of the offer will be based on your experience and skills, so we encourage you to apply even if you don’t meet every qualification listed for SOC II.

This position is responsible for conducting the technical aspects of response operations for critical events. These operations include immediate containment, investigation, and management of remediation actions, as well as enhancing defenses with the new knowledge acquired throughout the response process. This role requires the ability to develop skills on multiple security products and work closely with the staff of higher tiers, service delivery, and clients to provide ongoing communication of status and timely response to tickets.

• Review the latest alerts to determine relevancy and urgency (SOC I).
• Respond to the latest alerts to determine relevancy and urgency (SOC II).
• Create new trouble tickets for alerts that signal an incident and require Tier 2 / Incident Response review (SOC I).
• Triage escalated trouble tickets for alerts that signal an incident and require Tier 3 / Incident Response review (SOC II).
• Eyes on glass monitoring of security incidents within established customer Service Level Agreements (SOC I).
• Monitor advanced security alerts/incidents within established customer Service Level Agreements (SOC II).
• Assist as required in the remediation of critical information security incidents (SOC I).
• Assist SOC Analyst I as required in the remediation of critical information security incidents (SOC II).
• Review trouble tickets generated by other team members.
• Review and collect asset data (configs, running processes, etc.) on these systems for further investigation.
• First responder to security event escalations via email, phone, and ticket.
• Communicate positively with clients and escalate any issues and messages accordingly.
• Manage and monitor assigned security platforms while following established procedures.
• Complete assigned projects on time and with excellent quality.
• Practice continual self-improvement through education, training, and certification.
• Write documentation for tasks, procedures, and knowledgebase articles needed to support the understanding and efficiency of SOC services.
• Assist with determining client needs and obtaining clarification as required to appropriately triage client requests to the appropriate resource.
• Flexible on-call as needed to support 24/7/365 security operations.
• Operate with integrity and accountability.
• Uphold the values of ProCircular and abide by the Company handbook.
• Other duties as assigned.

Qualifications

• Knowledge of SOC solutions (EDR, SOAR, SIEM).
• Knowledge of core security devices such as firewalls, network, and host-based intrusion detection systems, web applications, AV, WAF, Proxy, and operating system logs.
• Ability to interpret IOCs.
• Develop and maintain content and reporting.
• Technical-minded and driven.
• Experience with Windows and Linux.
• Experience with network technologies and systems, security, and network monitoring tools.
• Thorough understanding of the latest security principles, techniques, and protocols.
• Capable of working effectively independently and in a team environment.
• Must be self-motivated, goal and detail-oriented.
• Flexible and adaptable to changing work environment.
• Ability to prioritize multiple tasks and manage time efficiently.
• Must be able to use Microsoft Office Suite efficiently.
• Proficient in at least one programming and scripting language (e.g., Python).
• Basic Firewall rule and policy fundamentals.
• Good written and oral communication skills. Natural curiosity to get to the root cause. Ability to remain calm under pressure.
• Experience working with customers via the phone.
• Experience in networks communications, network/data analysis, packet capture analysis, malware detection, and custom intrusion signature development concepts (SOC II).

Requirements

• Experience with various Cybersecurity products, but not limited to SIEM, SOAR, EDR, and XDR.
• Hands-on experience in security systems, including firewalls, intrusion detection systems, anti-virus software, authentication systems, log management, content filtering, etc.
• Experience working with internal and client ticketing and knowledge base systems for Incident and Problem Tracking, as well as procedures (e.g., Jira, Confluence, etc.).
• Experience writing suppression and detection rules.
• Knowledge of Active Directory Environments.
• Knowledge of packet-level analysis using appropriate tools (e.g., Wireshark, tcpdump).
• Knowledge of Intrusion Detection System (IDS)/Intrusion Prevention System (IPS) tools and applications.
• Knowledge of network protocols such as TCP/IP, Dynamic Host Configuration, Domain Name System (DNS), and directory services.
• Understanding various server-grade applications such as DBMS, Exchange, DNS, SMTP, IIS, Apache, SharePoint, Active Directory, Identity Management, Vulnerability/Patch Management, LDAP, SQL, and others.
• Prior experience working with container-based technologies such as Docker and Kubernetes.
• Prior consulting experience (SOC II).
• Knowledgeable in cybersecurity analysis/operations, systems administration, information security, vendor troubleshooting, business processes, information systems, SQL, Linux, risk management, Java, Python, PowerShell, and JSON (SOC II).
• Able to address incident handling (identification, overview, and preparation), buffer overflow, client attacks, covering tracks (networks, systems), denial of service attacks, incident handling (containment, eradication, recovery, and lessons learned), network attacks, password attacks, reconnaissance, scanning (discovery and mapping, techniques and defense), session hijacking and cache poisoning, methods for maintaining access, web applications attacks, worms, bots, and bot-nets (SOC II).
• Basic knowledge and understanding of addressing new attack vectors (emphasis on cloud computing technology, mobile platforms, and tablet computers), new vulnerabilities, existing threats to operating environments, advanced IDS concepts, applications protocols, concepts of TCP/IP and the link layer, DNS, fragmentation, IDS fundamentals and initial deployment (e.g., snort, Zeek), IDS rules (e.g., snort, Zeek), IPv6, network architecture and event correlation, network traffic analysis and forensics, packet engineering, SiLK and other traffic analysis tools, TCP, Tcpdump filters, UDP and ICMP, Wireshark fundamentals (SOC II).

Benefits

• Full-time employees are eligible for medical, dental, and vision coverage.
• Employer-paid basic life, AD&D, and disability insurance.
• Voluntary life, critical illness, and accident insurance.
• A health savings account (HSA) or health care flexible spending account (FSA).
• A 401(k) retirement plan with company match.
• Educational assistance.
• Adoption assistance (after 180 days of service).
• 20 days (160 hours) of paid time off per year to start, increasing with years of service.
• 12 paid holidays and 3 floating holidays (including your birthday).
• Access to an employee assistance program, caregiver support, financial wellbeing coaching, pretax commuter benefits, training and development programs, and employee discounts.