Security Specialist-SOC L3

Introduction
Information and Data are some of the most important organizational assets in today’s businesses. As a Security Consultant you will be a key advisor for IBM’s clients analyzing business requirements to design and implement the best security solutions for their needs. You will apply your technical skills to find the balance between enabling and securing the client’s organization with the cognitive solutions that are making IBM the fastest growing enterprise security business in the world.

Your Role and Responsibilities
As a Security Delivery Specialist-SOC you are responsible for managing day to day operations of Security Device Management SIEM Arcsight Qradar incident response threat hunting Use case engineering SOC analyst device integration with SIEM.
Come join our team of IBM experts who are leaders with vision distinguished engineers and IT architects who have worked with thousands of clients to transform enterprise IT migrate to cloud apply automation and ensure business continuity. We help client run their IT better accelerate innovation and deliver unmatched performance with the power automation.
If you thrive in a dynamic reciprocal workplace IBM provides an environment to explore new opportunities every single day. And if you relish the freedom to bring creative thoughtful solutions to the table there’s no limit to what you can accomplish here.
Role and Responsibilities

• Overall responsible for Incident response analysis and recommendation through SIEM and EDR.
• Responsible for threat hunting activity using SIEM EDR and other hunting tools and technologies.
• Good understanding of Mitre Framework NIST framework and Cyber Kill Chain Process.
• Overall responsible for SIEM and EDR platform.
• Mentor and support L1 and L2 team for technical expertise and skills.
• Responsible for L1 and L2 team members skill development and trainings.
• Handle L2 and above level technical escalations from L1 Operations team and resolve within SLA.
• Drive Process and technology standardization.
• Walkthrough of the daily weekly and monthly SOC reports to the customer/stake holders.
• Finetune of existing use case of SIEM to reduce false positive.
• Drive task automations jointly with automation team.
• Participate in periodic customer meetings.
• Create and manage various KEDBs the SOPs runbooks asset inventory with
• risk classification critical application flow diagram network flow diagram privileged user list. Ready to work in 24×7 rotational shift model including night shift.
• Mentor and monitor team members for their daily activities.
• Create and manage various KEDBs the SOPs runbooks asset inventory with risk classification critical application flow diagram network flow diagram privilege user list.
• Identify the process and technology gaps and drive for closure.
• Explore different technologies available in the security industry.
• Analyse and tune threat monitoring dashboards.
• Closely work with SOC team and be responsible for incident detection triage analysis and response.
• Performing TI based and hypothesis driven threat hunting oriented to SIEM logs.
• Support the incident response team during major security incident with advance investigation skills.

Required Technical and Professional Expertise

• 2-4 + years of IT experience in security with at least 2+ Years in Security Operation centre with SIEMs EDR Threat Hunting Threat Intelligence and knowledge on various cloud platform.
• Expertise in Security Device Management SIEM Arcsight Qradar Slunk incident response threat hunting Use case engineering device integration with SIEM Various error notification management in SIEM and EDR.
• Working knowledge of industry standard risk governance and security standard methodologies
• Proficient in incident response processes – detection triage incident analysis remediation and reporting
• Has good presentation skill with PPT preparation and competence with Microsoft Office e.g. Word PowerPoint Excel Visio etc.
• Ability to multitask and work independently with minimal direction and maximum accountability.

Preferred Technical and Professional Expertise

• One or more security certifications: CEH ECIH Security+ CISSP OSCP etc.
• You love collaborative environments that use agile methodologies to encourage creative design thinking and find innovative ways to develop with cutting edge technologies.
• Ambitious individual who can work under their own direction towards agreed targets/goals and with creative approach to work.
• Proven interpersonal skills while contributing to team effort by accomplishing related results as needed.
• Up-to-date technical knowledge by attending educational workshops reviewing publications.