Franklin Templeton - IT Security Analyst - SIEM/SOAR

Principal IS Analyst IT Security

Position Title:

Principal IS Analyst IT Security

Department / Team:

R&T Global Info Security / Security Operations years of hands-on experience in Security Operations, Incident Response, Threat Detection, Threat Hunting, Detection Engineering, and related cybersecurity operations roles.

Working Model:

24x7 SOC environment with responsibility for supporting major incidents, security events, and operational initiatives.

Role Scope:

Provide technical leadership across Security Operations through advanced cyber threat detection, incident response, threat hunting, and continuous improvement of detection and response capabilities. The role contributes to the evolution of SOC processes, monitoring capabilities, investigation methodologies, and operational effectiveness while collaborating across security and technology teams to strengthen the organization's cyber resilience.

Role Summary:

The role is responsible for providing advanced technical expertise across security monitoring, threat detection, incident response, and threat hunting within a 24x7 Security Operations Center. It requires deep analytical and investigative capabilities to identify, analyze, and respond to sophisticated cyber threats across endpoints, networks, cloud, identity, email, applications, and enterprise security technologies.

The role contributes to the continued advancement of Security Operations by improving detection strategies, investigation methodologies, automation, operational processes, and threat hunting capabilities. It also provides technical guidance during complex security incidents, supports cross-functional cyber security initiatives, and helps strengthen the organization's overall detection and response maturity.

Core Objective:

Advance the organization's Security Operations capabilities by strengthening cyber threat detection, incident response, threat hunting, and operational effectiveness while continuously improving SOC maturity, detection coverage, and cyber resilience.

What is the Security Operations Center (SOC) responsible for?:

The SOC is responsible for continuously monitoring and improving the organizations security posture by preventing, detecting, analyzing, and responding to cybersecurity incidents using security tools, threat intelligence, defined processes, and operational response capabilities.

Key Responsibilities:

- Lead investigations and response for escalated security incidents, providing technical direction and coordination throughout the incident lifecycle.

- Perform advanced investigation and analysis of suspicious activity across endpoints, networks, identity, email, cloud, applications, and enterprise security technologies to identify sophisticated threats and determine scope, impact, and root cause.

- Lead proactive threat hunting activities using threat intelligence, indicators of compromise, attacker tactics, techniques and procedures (TTPs), behavioral analytics, and frameworks such as MITRE ATT&CK.

- Design, review, and continuously improve SIEM, EDR/XDR, and related detection rules, correlation logic, alert thresholds, monitoring use cases, and detection strategies to improve detection effectiveness and reduce false positives.

- Identify gaps in logging, monitoring, detection coverage, investigation methodologies, escalation processes, and response capabilities, recommending and driving improvements to strengthen Security Operations.

- Perform root cause analysis for significant security incidents and document findings, evidence, attack timelines, impact assessments, remediation recommendations, and lessons learned.

- Develop and maintain advanced SOC playbooks, investigation methodologies, response procedures, knowledge articles, and technical standards to improve investigation consistency and operational maturity.

- Collaborate with Security Engineering, Infrastructure, Cloud, Identity, Application, and other technology teams to enhance detective controls, monitoring capabilities, incident response readiness, and overall cyber resilience.

- Evaluate emerging threats, attack techniques, and security technologies, translating intelligence into improved monitoring, detection, and response capabilities.

- Provide technical guidance and mentorship to SOC analysts, promoting knowledge sharing, investigation quality, and consistent operational practices.

- Ensure investigation activities, technical findings, evidence, decisions, and stakeholder communications are accurately documented within case management and ticketing systems.

- Contribute to the continuous improvement of Security Operations through automation opportunities, operational enhancements, and adoption of industry best practices.

Required Qualifications and Experience:

- Educational background in Cybersecurity, Computer Science, Information Technology, Engineering, or a related discipline, preferably with cybersecurity-focused coursework, specialization, or practical security exposure.

- 8-10 years of progressive hands-on experience in Security Operations, incident response, threat detection, security monitoring, threat hunting, detection engineering, or related cybersecurity operations roles.

- Extensive hands-on experience with SIEM, SOAR and EDR/XDR platforms, including advanced investigation, incident response, threat analysis, and evidence collection.

- Strong understanding of security operations concepts, including threat detection, incident response, networking, operating systems, identity security, cloud security, endpoint security, and core cybersecurity principles.

- Experience designing and improving detection rules, correlation logic, monitoring use cases, and detection coverage across enterprise security platforms.

- Strong practical knowledge of MITRE ATT&CK, threat intelligence, indicators of compromise, attacker behavior, and advanced threat hunting techniques.

- Familiarity with common security frameworks and control references such as NIST, CIS, and related industry practices.

- Experience across cloud, identity, endpoint, email, network security, security analytics, and security automation technologies.

- Strong analytical thinking, technical leadership, communication, and collaboration skills, with the ability to mentor analysts and effectively support complex security investigations.

(ref:hirist.tech)