SOC

Description

• Acknowledge, analyse, and validate incidents triggered from correlated events through SIEM solutionoAcknowledge, analyse, and validate incidents received through other reporting mechanisms such as email, phone calls, management directions, etc.
• Collection of necessary logs that could help in the incident containment and security investigationo Escalate validated and confirmed incidents to SOC ManagerLeado Undertake first stages of false positive and false negative analysis

oUnderstand the structure and the meaning of logs from different log sources such as FW, IDS, Windows DC, Network appliances, AV and antimalware software, email security etc.

oOpen incidents in ITSM Platform to report the alarms triggered or threats detected. Analyst should properly include for each incident on SIEM all details related to the logs, alarms and other indicators identified in accordance with the intervention protocol and the SLA.

Skills Required

crowdstrike , EDR, Dlp, Siem, Itil, logrhythm