Security Operations Center Analyst

Introduction
At IBM work is more than a job – it’s a calling: To detect. To protect. To contain. To collaborate. To prevent. To outthink threats. Not just to do something better but to attempt what some would consider impossible. Are you ready to lead in this new era of technology and solve some of the world’s most challenging problems? If so let’s talk.

Your Role and Responsibilities

• Assist in establishing Global Security Monitoring discipline to support enterprise
• Analyze and respond to security threats from Firewall (FW) Intrusion Detection Systems (IDS) Intrusion Prevention Systems (IPS) Antivirus (AV) Endpoint Detection and Response (EDR) and other security threat data sources.
• Respond in a timely manner (within documented SLA).
• Document actions in cases to effectively communicate information to internal stakeholders as well has for historical retrieval.
• Adhere to policies procedures and security practices
• Resolve problems independently and understand escalation procedures.
• Conduct Security Monitoring activities to provide Security in Depth visibility into potential known and unknown threats that may pose risk to the IBM environment.
• Participate in security incidents and act as the technical Subject Matter Expert during significant security incidents.
• Utilize analytics to identify potential threats to the environment.
• Detect respond mitigate and report on cyber threats/incidents that may impact the environment.
• Collaborate with technical leads: Engineering Operations Service Desk Applications and BISOs on matters related to security monitoring across global footprint.
• Collaborate and serve as liaison to Managed and/or Unmanaged Security Service providers.
• Conduct Operations surrounding cyber security incident response technologies including network logging and forensics security information and event management tools security analytics platforms log search technologies and host-based forensics as applicable.
• Act as an internal information security consultant to the business and technology units advising on risks threats and control practices related to Rapid Response.
• Assist in development and knowledge sharing within the team.
• Assist in security console tuning
• Assist in security event oversight to ensure the team is delivering a quality product
• Identify and share threat intelligence that impacts IBM and their customers or products
• Perform threat hunts that target adversary TTPs

Required Technical and Professional Expertise

• Minimum 1+ years of experience working within a SOC Threat Hunt or Threat Intel team
• Critical thinking and problem-solving skills
• Passion for information security and data security
• Strong written/verbal communication skills
• Strong interpersonal and organization skills
• Knowledge in an industry recognized Security Response Framework

Preferred Technical and Professional Expertise

• Relevant industry recognized certifications (CISSP CISM GCIH ECEH Sec+ etc.)
• Strong understanding of networking protocols.
• Experience in fast-paced response.
• Experience with programming or scripting languages.
• Experience with Q-Rader SIEM tool is a plus.
• Experience with EDR platforms such as Crowdstrike Falcon and Microsoft Defender ATP.
• Experience with cloud computing platforms e.g. IBM Cloud Amazon Web Services Azure.
• Experience with host virtualization platforms e.g. VMware Hyper-V.
• Experience with application container technologies e.g. Docker.
• System administration skills for Windows and Linux.