RequirementsDuties and Responsibilities:
- Conduct the daily operations of the internal Cyber Security Team, including incident monitoring, analysis, and response.
- Monitor security events and alerts using Microsoft Defender, Microsoft Sentinel and other security technologies.
- Support major incident response efforts and lead on incident response efforts, including containment, investigation, analysist, and reporting of security incidents.
- Conduct post-incident analysis and recommend improvements to enhance the departments overall security posture.
- Collaborate with our SOC service management supplier to ensure the timely resolution of security issues and develop alerting and playbooks for services, IT engineers to ensure the proper configurations and management of security monitoring tools and technologies and with cross-functional teams to develop and improve incident response plans, playbooks, and standard operating procedures (SOPs).
- Analyse security incidents, conduct investigations, and determine the root cause of security breaches or anomalies and respond to security incidents, including containment, mitigation, and recovery actions, ensuring minimal impact on operations.
- Stay up to date with the latest security threats, vulnerabilities, and industry trends, sharing knowledge and insights with the team.
- Perform security log analysis, event correlation, and threat intelligence research to proactively identify potential security risks.
- Assist in the review of configuration of security technologies like Defender, Mimecast, Proofpoint, Umbrella. Essential Skills required: To be knowledgeable and able to demonstrate in depth technical understanding across several of the technologies/areas below:
- Hands-on experience with incident response and forensics tools, techniques, and methodology.
- Experience as a SOC analyst in an enterprise organisation.
- Strong knowledge of cyber security principles, frameworks, and best practices.
- In-depth understanding of security technologies, especially Microsoft Defender, Microsoft Sentinel, Mimecast, Proofpoint, Umbrella.
- Ability to analyse and interpret security logs, event data, and alerts to identify potential threats.
- Proven experience in a cybersecurity role, with a focus on security operations and incident response.
- Understanding of cybersecurity principles, frameworks, and best practices.
- Knowledge of network protocols, traffic analysis, and cyber-attack methodologies.
- Familiarity with incident response processes, methodologies, and tools.
- Strong problem-solving and analytical skills, with the ability to investigate and resolve security incidents effectively.
- Security Certifications CompTIA Security+ or CySA+ certified (or similar). Desired Vendor Knowledge/Awareness (not all of the below expected)
- Microsoft Defender
- Microsoft Sentinel
- Email Security tooling: o O365 o Mimecast o Proofpoint Key Competences required for the role:
- Interpersonal Skills & Communication
- Decision Making & Judgment
- Continuous Improvement
- Planning & Organizing
- Passionate
- Commercial Awareness
