2-4 years of experience in 24x7 (rotating shifts) monitoring at a Security Operations centre on SIEM solutions (Qradar)·
Triage, analyze & respond to SIEM events with articulate analysis and clear response guidance/questions to other teams through established collaboration mechanisms (Ticketing systems, Mails)
Good understanding of EDR Solutions (McAfee EDR, Crowd strike EDR).
Leverage the Operational & Tactical Threat Intel data from the established feeds & sources to detect Threats
Ability to efficiently utilize to log analytics and usage of QRadar for analyzing & filtering logs.
Optimizes threat detection products for data security information and event management (SIEM), advanced email protection, endpoint detection and response (EDR), antivirus, intrusion detection systems, firewalls, proxies, and other industry standard security technologies
Works closely with Level 2 & Level 3 team towards the continuous improvement of the service.
Should have understanding on TCP/IP network traffic and event log analysis.
Experience working in a Threat Intel team or Threat Hunting team would be a bonus.
Good Knowledge on Incident management life cycle and contribute to the development and improvement of security detection, Incident response process and solutions are required to support ongoing operations.